| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Set Password To Never Expire | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/set-password-to-never-expire.md | Run one of the following commands: - To set the password of one user to never expire, run the following cmdlet by using the UPN or the user ID of the user: ```powershell- Update-MgUser -UserId <user ID> -PasswordPolicies DisablePasswordExpiration -PassThru + Update-MgUser -UserId <user ID> -PasswordPolicies DisablePasswordExpiration ``` - To set the passwords of all the users in an organization to never expire, run the following cmdlet: ```powershell- Get-MGuser -All | Update-MgUser -PasswordPolicies DisablePasswordExpiration -PassThru + Get-MGuser -All | Update-MgUser -PasswordPolicies DisablePasswordExpiration ``` > [!WARNING] Run one of the following commands: - To set the password of one user so that the password expires, run the following cmdlet by using the UPN or the user ID of the user: ```powershell- Update-MgUser -UserId <user ID> -PasswordPolicies None -PassThru + Update-MgUser -UserId <user ID> -PasswordPolicies None ``` - To set the passwords of all users in the organization so that they expire, use the following cmdlet: ```powershell- Get-MGuser -All | Update-MgUser -PasswordPolicies None -PassThru + Get-MGuser -All | Update-MgUser -PasswordPolicies None ``` ## Related content |
| admin | Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/overview.md | You can manage and secure mobile devices when they're connected to your Microsof :::image type="content" source="../../media/basic-mobility-security/bms-3-setup.png" alt-text="Basic Mobility and Security Setup."::: +## Privacy and security in Basic Mobility and Security ++Microsoft Intune sends information to Microsoft 365 about the compliance status of each managed device, and then you can generate reports that show whether managed devices in your organization are compliant based upon the policies that were set. To learn more about Microsoft's commitment to the privacy and security, see the [Microsoft Trust Center](https://www.microsoft.com/trust-center). + ## What types of devices can you manage? You can use Basic Mobility and Security to manage many types of mobile devices like Android, iPhone, and iPad. To manage mobile devices used by people in your organization, each person must have an applicable Microsoft 365 license and their device must be enrolled in Basic Mobility and Security. Here's a summary of the steps: **Step 2:** Set up Basic Mobility and Security by, for example, creating an APNs certificate to manage iOS devices and adding a Domain Name System (DNS) record for your domain. -**Step 3:** Create device policies and apply them to groups of users. When you do this, your users get an enrollment message on their device, and when they've completed enrollment, their devices are restricted by the policies you've set up for them. For more info, see [Enroll your mobile device using Basic Mobility and Security](enroll-your-mobile-device.md). +**Step 3:** Create device policies and apply them to groups of users. When you do this, your users get an enrollment message on their device, and when they've completed enrollment, their devices are restricted by the policies you've set up for them. For more info, see [Enroll your mobile device using Basic Mobility and Security](enroll-your-mobile-device.md). :::image type="content" source="../../media/basic-mobility-security/basic-mobility-microsoft-purview.png" alt-text="Basic Security and Mobility policy settings."::: |
| admin | Privacy And Security | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/privacy-and-security.md | - Title: "Privacy and security in Basic Mobility and Security" --- Previously updated : 08/27/2020----- Tier3-- scotvorg -- M365-subscription-management-- Adm_O365-- Adm_TOC- -description: "After you activate Basic Mobility and Security, you can create mobile device management policies." ---# Privacy and security in Basic Mobility and Security --Basic Mobility and Security is a cloud-based service powered by Microsoft Intune that helps you manage and secure mobile devices in your organization. After you activate Basic Mobility and Security, you can create mobile device management policies. These policies can then be deployed to mobile devices that have been enrolled by licensed Microsoft 365 users in your organization. --Microsoft Intune sends information to Microsoft 365 about the compliance status of each managed device, and then you can generate reports that show whether managed devices in your organization are compliant based upon the policies that were set. To learn more about Microsoft's commitment to the privacy and security, see the [Microsoft Trust Center](https://www.microsoft.com/trust-center). |
| admin | Set Up | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/set-up.md | When the service is ready, complete the following steps to finish setup. If you don't have a custom domain associated with Microsoft 365 or if you're not managing Windows devices, you can skip this section. Otherwise, you'll need to add DNS records for the domain at your DNS host. If you've added the records already, as part of setting up your domain with Microsoft 365, you're all set. After you add the records, Microsoft 365 users in your organization who sign in on their Windows device with an email address that uses your custom domain are redirected to enroll in Basic Mobility and Security. -Need help setting up the records? Find your domain registrar and select the registrar name to go to step-by-step help for creating DNS record in the list provided in [Add DNS records to connect your domain](/office365/admin/get-help-with-domains/create-dns-records-at-any-dns-hosting-provider). Use those instructions to create CNAME records described in [Simplify Windows enrollment without Azure AD Premium](/mem/intune/enrollment/windows-enroll#simplify-windows-enrollment-without-azure-ad-premium). +Need help setting up the records? Find your domain registrar and select the registrar name to go to step-by-step help for creating DNS records in the list provided in [Add DNS records to connect your domain](/office365/admin/get-help-with-domains/create-dns-records-at-any-dns-hosting-provider). Use the following details to create CNAME records: ++| Type | Host name | Points to | TTL | +| | | | | +| CNAME | EnterpriseEnrollment.company_domain.com | EnterpriseEnrollment-s.manage.microsoft.us | 1 hour| +|CNAME | EnterpriseRegistration.company_domain.com | EnterpriseRegistration.windows.net | 1 hour | After you add the two CNAME records, go back to the Security & Compliance Center and go to **Data loss prevention** > **Device management** to complete the next step. |
| admin | Manage Deployment Of Add Ins | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/manage-deployment-of-add-ins.md | Before you begin, see [Determine if Centralized Deployment of add-ins works for 2. Select **Deploy Add-in** at the top of the page, and then select **Next**. + > [!NOTE] > You can also deploy add-ins in the admin center through [Integrated Apps](test-and-deploy-microsoft-365-apps.md). Integrated Apps is visible to Global and Exchange administrators. If you don't see the above steps, go to the Centralized Deployment section by going to **Settings** > **Integrated apps**. On the top of the **Integrated apps** page, choose **Add-ins**. 3. Select an option and follow the instructions.+ 4. If you selected the option to add an add-in from the Office Store, make your add-in selection. </br> - You can view available add-ins by categories: **Suggested for you**, **Rating**, or **Name**. Only free add-ins are available from the Office Store. Paid add-ins aren't supported currently. After you select an add-in, accept the terms and conditions to proceed. <br/> + You can view available add-ins by categories: **Suggested for you**, **Rating**, or **Name**. Only free add-ins are available from the Office Store. Paid add-ins aren't supported currently. After you select an add-in, accept the terms and conditions to proceed. <br/> + > [!NOTE] > With the Office Store option, updates and enhancements are automatically deployed to users. 5. On the next page, select **Everyone**, **Specific users/groups**, or **Just me** to specify who the add-in is deployed to. Use the Search box to find specific users or groups. <br/> + > [!NOTE] > To learn about other states that apply to an add-in, see [Add-in states](./manage-addins-in-the-admin-center.md).- + 6. Select **Deploy**. 7. A green tick appears when the add-in is deployed. Follow the on-page instructions to test the add-in. |
| admin | Deleted Users Checklist | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/misc/deleted-users-checklist.md | - Title: "Quick help Deleted users checklist"-- NOCSH--- Previously updated : 02/18/2020----- scotvorg-- M365-subscription-management -- Adm_O365-- Adm_NonTOC--- BCS160-- MET150-- MOE150- -description: "Follow this checklist while deleting a user's Microsoft 365 account." ---# Quick help: Deleted users checklist --So, you've decided to delete a user from your organization. For example, you can delete a user once that person leaves your organization. There are a few things you should do before and after you delete that user. This quick checklist helps you with the steps. - -## Remove the Microsoft 365 license from the user --You can remove a license from a user by searching for the user on the home page, or from the **Active users** page, and then selecting them. On the **Licenses and Apps** tab, clear the check box for the license you want to remove from the user. [Read full article](../manage/remove-licenses-from-users.md). - -## Block sign in --You can block the user so they can't sign in to your organization. You can search for the user on the home page, or from the **Active users** page, and then select them. At the top of the pane, under the user's name, select the **Block this user** icon, and then select the **Block this user from signing in** check box. [Read full article](../add-users/assign-admin-roles.md). - -## Get their data --You can send this user's email to another employee or user in your organization by following these [steps](../add-users/remove-former-employee.md). You can also back up and save any data from the former employee by following these [steps](../add-users/get-access-to-and-back-up-a-former-user-s-data.md). - -## Delete user --You can delete the user by searching for the user on the home page, or from the **Deleted users** page. Select the user and select **Delete user**. [Read full article](../add-users/delete-a-user.md). - -## What to do with the unassigned license --If you have a new employee or person that's joining your organization, you can assign them this license so they can use Microsoft 365. You can search for the user on the home page, or from the **Active users** page, and then select them. On the **Licenses and Apps** tab, select the check box for the license you want to add to the new user. [Read full article](../manage/assign-licenses-to-users.md). - -## Remove license so you don't have to pay for it --You can also remove license from your subscription so you don't have to pay for it. From the admin center home page, type **subscription** and select **View subscriptions**. Select **Add/remove licenses**. In the **Total licenses** box, enter the total number of licenses that you need for this subscription and then select **Submit change**. For example, if you had 5 licenses and you need to remove 1 of them, you would enter **4**. [Read full article](../../commerce/licenses/buy-licenses.md). |
| admin | Message Center Conformance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/misc/message-center-conformance.md | - Title: "Conformance metadata for Message Center posts"-- CSH--- Previously updated : 02/18/2020---- -description: "Get an overview of conformance metadata for Message center posts" ---# Conformance metadata for Message Center posts --> [!IMPORTANT] -> This private document is only for Change Management: Conformance metadata users. Don't share this document beyond those who are directly involved in the pilot. --When planning for new features or service deployments, you would like to understand and assess the changes for conformance to your industry, region and country. We've heard your feedback when there's insufficient conformance information about a new or changing feature, you have to conduct your own research about the feature or reach out to the Compliance Program with questions. --In this pilot program, we want to proactively provide metadata for new and updated Microsoft 365 features and services. Our goal is to help you efficiently assess your compliance requirements and help you with adoption and change management decisions. --For example, if for a feature the metadata has the following values, feature adoption decision should be quick. --- Customer data is stored? **No**--- Change to customer data storage? **No**--- Changes to existing data flow? **No**--- Feature integrates with third party services? **No**--> [!NOTE] -> The above list is slightly different from what you previously saw in the pilot conformance posts. We've updated the list based on feedback we've received from pilot customers. --For features where the metadata is different from the list above, the Message center post may provide you with documentation. --## Understanding conformance metadata --|**Metadata name**|**Values**|**Definition and questions asked**|**Example: Yes**|**Example: No**| -||||| -|**Customer data is stored**|Yes/No|Does this change store or process any net new data (classified as customer or personal data) which wasn't previously stored or processed by the service/previous version of this feature?|Teams Meetings recordings capturing and collecting customer data and is now stored in.|Message Center Service monthly active users (MAU) feature shows the aggregated service monthly active users for a tenant ID which isn't classified as customer or personal data.| -|**Change to customer data storage**|Yes/No|Does this change use a new or different service to store data|Teams Meetings Recordings capturing/collecting customer data/content and is now stored in.|Expanded reactions in Teams. Expanding message reactions in Teams to a larger set. The newer reactions being stored are customer data, however, there's no change in how data is stored or processed.| -|**Changes to existing data flow**|Yes/No|Does this feature process data via a new or different processing pipeline? <br> Or <br> Is the feature just extending an existing processing pipeline to newer data or exposing data already exposed on one surface to another surface? (**Answer = No**).|When Bing for Business started using text from Word to send to Bing then bring data back to Word, the flow of data changed.|Productivity score being used on the Experience Insights page in admin center, the data is shown on a new surface, but storage and processing is the same. <br> Suggested Reply in Group Chats on Teams Desktop (an extension of 1:1 chats) doesn't have any net new data. It's an extension of the pipeline already set up for Suggested Reply in 1:1 chats.| -|**Feature integrates with third party services**|Yes/No|Does this feature utilize a net new service or app (first party or third party) that customer data could potentially be stored or processed outside of Microsoft 365?|Bing for Business may receive customer content in the form of "search" data to present a user with potentially relevant information/content.|Message Center Service monthly active users (MAU) feature shows the service monthly active users using Usage Report Graph API which is within Microsoft 365 boundary.| -| --## Join the pilot program --You can join by completing this [questionnaire](https://go.microsoft.com/fwlink/p/?linkid=2211581). --When a Message center post is delivered, you'll receive an additional Message Center post that says: **Additional Conformance Information for MC######**. This post contains more conformance metadata. You can provide feedback directly on the extra post or you can email: MCSHDPMS@Microsoft.com. You can also send feedback on the [Teams channel](https://go.microsoft.com/fwlink/p/?linkid=2211676). --> [!NOTE] -> WeΓÇÖll start with features from Microsoft Teams, OneDrive for Business and SharePoint Online. |
| bookings | Campaign Id | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/campaign-id.md | - Title: "Add a marketing campaign ID to a Bookings page URL"--- Previously updated : 05/10/2022----- Tier1-- scotvorg -description: "How to add a campaign ID to a Bookings page URL" ---# Add a marketing campaign ID to a Bookings page URL --Keep track of your Bookings marketing campaigns by adding a campaign ID to the end of your Booking page URL. --Use a campaign ID to see how your marketing campaigns are doing. Add a campaign ID you choose to the end of your Bookings page URL and use the campaign ID in your different marketing platforms to see which of your campaigns are connecting with customers. --## Add campaign ID --1. In Microsoft 365, select the App launcher, and then select **Bookings**. --2. Choose your calendar and in the left navigation pane, select **Booking page** and copy your booking page URL and paste it into a text editing program, like Notepad. -- :::image type="content" source="../media/copy-booking-page-url.png" alt-text="Screenshot: Copy Bookings page URL so you can add a campaign ID for marketing"::: --3. Add a campaign ID to the end of the Booking page URL. For example, if your booking page URL looks like this, [https://outlook.office365.com/owa/calendar/TailspinToys@contosopetscom.onmicrosoft.com/bookings/](https://outlook.office365.com/owa/calendar/TailspinToys@contosopetscom.onmicrosoft.com/bookings/), you would choose an ID to add to the end. For example, if you wanted to track your booking details from your Twitter page, you could add Twitter to the end of the URL. The new URL that you would add to your Twitter page would look like this: [https://outlook.office365.com/owa/calendar/TailspinToys@contosopetscom.onmicrosoft.com/bookings/?RefID=Twitter](https://outlook.office365.com/owa/calendar/TailspinToys@contosopetscom.onmicrosoft.com/bookings/?RefID=Twitter). Use different campaign IDs to track the marketing campaigns you're running. --> [!NOTE] -> Characters in the campaign ID must be one of the following: alphanumeric characters, underscore or hyphen. Make sure you test your Campaign ID url by copying and pasting into a web browser. --## Track campaign IDs --You can track how your campaigns are doing by downloading a report (TSV file) that shows you the last four months of activities of your Bookings calendar. The TSV file will show you four months of data, but you can select different four month periods over the course of a year. For more information on how to download the report, see [Reporting info for Bookings](reporting-info.md). |
| bookings | Customize Booking Page | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/customize-booking-page.md | Once you publish your booking page, customers will see your booking page where t :::image type="content" source="media/bookings-self-service-2.png" alt-text="Customer facing booking page."::: -<!-- ## Publish the booking page +## Add a marketing campaign ID to a Bookings page URL -Watch this video or follow the steps below to publish or unpublish your booking page. +Keep track of your Bookings marketing campaigns by adding a campaign ID to the end of your Booking page URL. -> [!VIDEO https://www.microsoft.com/videoplayer/embed/RWuYil] +Use a campaign ID to see how your marketing campaigns are doing. Add a campaign ID you choose to the end of your Bookings page URL and use the campaign ID in your different marketing platforms to see which of your campaigns are connecting with customers. -1. In Microsoft 365, select the app launcher, and then select **Bookings**. +## Add campaign ID ++1. In Microsoft 365, select the App launcher, and then select **Bookings**. ++2. Choose your calendar and in the left navigation pane, select **Booking page** and copy your booking page URL and paste it into a text editing program, like Notepad. ++ :::image type="content" source="../media/copy-booking-page-url.png" alt-text="Screenshot: Copy Bookings page URL so you can add a campaign ID for marketing"::: -1. In the navigation pane, select **Booking page**. +3. Add a campaign ID to the end of the Booking page URL. For example, if your booking page URL looks like this, [https://outlook.office365.com/owa/calendar/TailspinToys@contosopetscom.onmicrosoft.com/bookings/](https://outlook.office365.com/owa/calendar/TailspinToys@contosopetscom.onmicrosoft.com/bookings/), you would choose an ID to add to the end. For example, if you wanted to track your booking details from your Twitter page, you could add Twitter to the end of the URL. The new URL that you would add to your Twitter page would look like this: [https://outlook.office365.com/owa/calendar/TailspinToys@contosopetscom.onmicrosoft.com/bookings/?RefID=Twitter](https://outlook.office365.com/owa/calendar/TailspinToys@contosopetscom.onmicrosoft.com/bookings/?RefID=Twitter). Use different campaign IDs to track the marketing campaigns you're running. -1. Verify your scheduling policies are correct. See [Set your scheduling policies](set-scheduling-policies.md) for more information. +> [!NOTE] +> Characters in the campaign ID must be one of the following: alphanumeric characters, underscore or hyphen. Make sure you test your Campaign ID url by copying and pasting into a web browser. -1. Select **Save and publish**. You'll see a confirmation message. +### Track campaign IDs -1. Select **Open published page** to see your page in a web browser. --> +You can track how your campaigns are doing by downloading a report (TSV file) that shows you the last four months of activities of your Bookings calendar. The TSV file will show you four months of data, but you can select different four month periods over the course of a year. For more information on how to download the report, see [Reporting info for Bookings](reporting-info.md). ## Unpublish the booking page |
| bookings | Define Service Offerings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/define-service-offerings.md | You can also add customized information and URLs to the email confirmation and r 7. On the **Notifications** page, you can send SMS messages, set up reminders, and send notifications. - - **Enable text message notifications for your customer** If selected, SMS messages are sent to the customer, but only if they opt in. - - **Reminders and notifications** are sent out to customers, staff members, or both, at a specified time before the appointment. Multiple messages can be created for each appointment, according to your preference. +> [!NOTE] +> Text message notifications in Bookings requires a Teams Premium license. ++**Enable text message notifications for your customer** If selected, SMS messages are sent to the customer, but only if they opt in. ++**Reminders and notifications** are sent out to customers, staff members, or both, at a specified time before the appointment. Multiple messages can be created for each appointment, according to your preference. :::image type="content" source="media/bookings-remind-confirm-2.png" alt-text="A confirmation email from Bookings."::: |
| enterprise | Lang Service Health | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/lang-service-health.md | - Title: "Language translation for Service health dashboard"--- Previously updated : 07/26/2021---- CSH--- Adm_O365-- 'O365P_ServiceHealthModern'-- 'O365M_ServiceHealthModern'-- 'O365E_ViewStatusServices'-- 'O365E_ServiceHealthModern'-- 'seo-marvel-apr2020'--- Tier3-- scotvorg-- Ent_O365-- M365-subscription-management-- MET150-- MOE150-- BCS160-- IWA160 -description: "Service health dashboard posts are in English only but can be displayed automatically in the language you specify for Microsoft 365." ---# Language translation for Service health dashboard --Service health dashboard posts are written in English-only due to the timeliness of the information we are posting, but can be automatically displayed in the language specified by your personal language settings for Microsoft 365. If you set your preferred language to anything other than English, you'll see an option in the Service health dashboard to automatically translate posts. The messages are machine translated to your preferred language, meaning that a computer did the translation. This option controls the default view, but you can also use the drop-down menu to translate and display posts in any of the languages we support for translation. If you select English, we'll revert the message to the original English version. --## Before you begin --> [!IMPORTANT] -> Before you can choose your language settings, you have to set your preferred language. No translation options are shown when your language is set to English. You can't specify a preferred language for others, each person has to change this setting for themselves. --## Set your preferred language --1. Go to the Microsoft 365 admin center [https://admin.microsoft.com](https://go.microsoft.com/fwlink/p/?linkid=2024339), or home page, select the settings icon in the upper-right corner of the page. --1. Under **Language and time zone**, select **View all** to show the available options. Select your desired language from the drop-down menu, and then select **Save**. Microsoft 365 will try to refresh and display the new language. If that doesn't happen immediately or if it seems that it's taking too long, you can either refresh your browser or sign out and then sign back in. --## Machine translation in Service health dashboard --When your preferred language isn't set to English, the translation options are available. --To set Service health dashboard posts to automatically machine-translate and display in your preferred language, go to Health > Service health dashboard. You'll see a switch at the top of the view to toggle automatic translation on or off. When this setting is off, posts are shown in English. When this setting is on, messages display in your preferred language. The setting you choose will persist for each visit. --## Related topics --[How to check Microsoft 365 service health](view-service-health.md) --[How to check Windows release health on admin center](/windows/deployment/update/check-release-health) --[Message center Preferences](../admin/manage/message-center.md?preserve-view=true&view=o365-worldwide#preferences) |
| enterprise | View Service Health | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/view-service-health.md | Service health lets you look at your current health status and view the history For more information about our commitment to uptime, see [Transparent operations from Microsoft 365](/office365/servicedescriptions/office-365-platform-service-description/service-health-and-continuity). +## Language translation for Service health dashboard ++Service health dashboard posts are written in English-only due to the timeliness of the information we are posting, but can be automatically displayed in the language specified by your personal language settings for Microsoft 365. If you set your preferred language to anything other than English, you'll see an option in the Service health dashboard to automatically translate posts. The messages are machine translated to your preferred language, meaning that a computer did the translation. This option controls the default view, but you can also use the drop-down menu to translate and display posts in any of the languages we support for translation. If you select English, we'll revert the message to the original English version. ++Before you can choose your language settings, you have to set your preferred language. No translation options are shown when your language is set to English. You can't specify a preferred language for others, each person has to change this setting for themselves. ++## Set your preferred language ++1. Go to the Microsoft 365 admin center [https://admin.microsoft.com](https://go.microsoft.com/fwlink/p/?linkid=2024339), or home page, select the settings icon in the upper-right corner of the page. ++1. Under **Language and time zone**, select **View all** to show the available options. Select your desired language from the drop-down menu, and then select **Save**. Microsoft 365 will try to refresh and display the new language. If that doesn't happen immediately or if it seems that it's taking too long, you can either refresh your browser or sign out and then sign back in. ++## Machine translation in Service health dashboard ++When your preferred language isn't set to English, the translation options are available. ++To set Service health dashboard posts to automatically machine-translate and display in your preferred language, go to Health > Service health dashboard. You'll see a switch at the top of the view to toggle automatic translation on or off. When this setting is off, posts are shown in English. When this setting is on, messages display in your preferred language. The setting you choose will persist for each visit. + ## Related topics - [Activity Reports in the Microsoft 365 admin center](https://support.office.com/article/0d6dfb17-8582-4172-a9a9-aed798150263) |
| frontline | Sms Notifications Usage Report | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/sms-notifications-usage-report.md | appliesto: - Microsoft Teams - Microsoft 365 for frontline workers Previously updated : 08/25/2023 Last updated : 08/29/2023 # Microsoft Teams SMS notifications usage report Here are the delivery status values that you may see in the report and what they |Status |Description | |||-|Sent|Notification delivered to the recipientΓÇÖs phone.| +|Delivered|Notification delivered to the recipientΓÇÖs phone.| |Not Delivered ΓÇô Blocked by recipient|Recipient doesn't want to receive messages and opted out.| |Not Delivered ΓÇô Invalid phone number|The number has an invalid format for the destination| |Not Delivered - Phone number doesn't exist|The number has a valid prefix and format but doesn't exist or isn't allocated.| |
| loop | Loop Workspaces Storage Permission | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/loop/loop-workspaces-storage-permission.md | Loop workspaces don't use Microsoft 365 groups for access management, instead th Loop content (pages and components) created in the Loop app are discoverable and have eDiscovery workflow support using the Microsoft Purview tool. As mentioned above, these files are stored in [Syntex repository services](https://devblogs.microsoft.com/microsoft365dev/introducing-syntex-repository-services-microsoft-365-superpowers-for-your-app/) and are available for search and collection, and render in review for both eDiscovery (Standard) and eDiscovery (Premium). The HTML offline export format is supported on eDiscovery (Premium). You can also download and re-upload the files to any OneDrive to view them in their native format. -A [graph export API](/graph/api/driveitem-get-content-format) solution is also available for Loop pages and components that support both raw export and an HTML offline format. +A graph export API that can access Loop content stored in [Syntex repository services](https://devblogs.microsoft.com/microsoft365dev/introducing-syntex-repository-services-microsoft-365-superpowers-for-your-app/) is not yet available. ## Storage management after user departure |
| security | Attack Surface Reduction Rules Deployment Operationalize | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-operationalize.md | Title: Operationalize attack surface reduction (ASR) rules description: Provides guidance to operationalize your attack surface reduction rules deployment. -keywords: Attack surface reduction (ASR) rules deployment, Microsoft ASR, manage defender ASR rules, monitor asr rules, asr rules advanced hunting, ASR rules report, asr rules false positives, configure ASR, host intrusion prevention system, protection rules, anti-exploit rules, anti-exploit, exploit rules, infection prevention rules, Microsoft Defender for Endpoint, configure ASR rules -search.product: eADQiWindows 10XVcnh -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium ASR events shown in the advancing hunting portal are throttled to unique process DeviceEvents | where Timestamp > ago(30d) | where ActionType startswith "Asr"-| summarize EventCount=counst() by ActionType +| summarize EventCount=count() by ActionType ``` > [!div class="mx-imgBorder"] |
| security | Deployment Strategy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deployment-strategy.md | Depending on your environment, some tools are better suited for certain architec ||| |**Cloud-native**| We recommend using Microsoft Intune to onboard, configure, and remediate endpoints from the cloud for enterprises that don't have an on-premises configuration management solution or are looking to reduce their on-premises infrastructure. | |**Co-management**| For organizations that host both on-premises and cloud-based workloads we recommend using Microsoft's ConfigMgr and Intune for their management needs. These tools provide a comprehensive suite of cloud-powered management features, as well as unique co-management options to provision, deploy, manage, and secure endpoints and applications across an organization. |-|**On-premise**|For enterprises that want to take advantage of the cloud-based capabilities of Microsoft Defender for Endpoint while also maximizing their investments in Configuration Manager or Active Directory Domain Services, we recommend this architecture.| +|**On-premises**|For enterprises that want to take advantage of the cloud-based capabilities of Microsoft Defender for Endpoint while also maximizing their investments in Configuration Manager or Active Directory Domain Services, we recommend this architecture.| |**Evaluation and local onboarding**|We recommend this architecture for SOCs (Security Operations Centers) that are looking to evaluate or run a Microsoft Defender for Endpoint pilot, but don't have existing management or deployment tools. This architecture can also be used to onboard devices in small environments without management infrastructure, such as a DMZ (Demilitarized Zone).| ## Step 2: Select deployment method |
| security | Run Analyzer Macos Linux | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/run-analyzer-macos-linux.md | If using a terminal download using the command: 2. Verify the download. > [!NOTE]- > The current SHA256 hash of 'XMDEClientAnalyzerBinary.zip' that is downloaded from the above link is: '32f1d67448773e3eda5b26cab332ccf9686ad9740be8a9624d7d02347b0af365' + > The current SHA256 hash of 'XMDEClientAnalyzerBinary.zip' that is downloaded from the above link is: 'F0C48E4FF92851ED8FF2E70E80AB278399C893AD45E70F20B53672D5463AF61D' ```console- echo '32f1d67448773e3eda5b26cab332ccf9686ad9740be8a9624d7d02347b0af365 XMDEClientAnalyzerBinary.zip' | sha256sum -c + echo 'F0C48E4FF92851ED8FF2E70E80AB278399C893AD45E70F20B53672D5463AF61D XMDEClientAnalyzerBinary.zip' | sha256sum -c ``` 3. Extract the contents of <i>XMDEClientAnalyzerBinary.zip</i> on the machine. When using a terminal, unzip the file using one of the following commands based 2. Verify the download ```console- echo '78e8f2078313ff2d3314c0c992ec5af370b5940a7adf7e416a5224d31d2691e5 XMDEClientAnalyzer.zip' | sha256sum -c + echo 'D21A5DD6705589705227B0E773EDAB86CB31E7FC8DB5F52EE23F581759838AD2 XMDEClientAnalyzer.zip' | sha256sum -c ``` 3. Extract the contents of XMDEClientAnalyzer.zip on the machine.\ |
| security | Fixed Reported Inaccuracies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/fixed-reported-inaccuracies.md | Inaccuracy report ID |Description |Fix date | | - |Fixed inaccuracy in NetScaler Gateway Plugin| 03-Aug-23 | - |Added Microsoft Defender Vulnerability Management support for Azul products| 09-Aug-23 |30082 |Fixed inaccuracy in CVE-2022-43946| 09-Aug-23-| - |Added accurate EOS details for Outlook (2010 & 2013) and Office build versions(2304,2305,1902,1908,2008,2202)| 10-Aug-23 +| - |Added accurate EOS details for Outlook (2010 & 2013) and Office build versions: </br> (2304,2305,1902,1908,2008,2202)| 10-Aug-23 |30002 |Fixed inaccuracy in KeePass versions| 10-Aug-23 | - |Added MDVM support to ODBC and OLEDB| 10-Aug-23 |29552 |Fixed inaccuracy in Dell Command Update| 14-Aug-23 Inaccuracy report ID |Description |Fix date | ## July 2023 -Inaccuracy report ID |Description |Fix date | +|Inaccuracy report ID |Description |Fix date | |:|:|:|-|24162 |Fixed inaccuracy in MYSQL Workbench| 04-Jul-23 -|25736 | Fixed inaccuracy in KeePass | 04-Jul-23 -|24598 | Fixed inaccuracy in Adobe Flash Player plugins |04-Jul-23 -| - |Defender Vulnerability Management doesn't currently support assessment for these Lenovo CVEs: </br> CVE-2021-3519, CVE-2021-22499, CVE-2021-22500, CVE-2021-22514| 03-Jul-23 -| - |Added Microsoft Defender Vulnerability Management support for Arcserve UDP | 05-Jul-23 -| - |Added accurate EOS details for Log4j versions| 05-Jul-23 -|27379 | Fixed inaccuracy in Adobe Animate | 06-Jul-23 -| - |Added Arcserve UDP affected product details in CVE-2023-26258 |05-Jul-23 -|26391 | Fixed inaccuracy in CVE-2020-26941 | 09-Jul-23 -|25245 | Fixed inaccuracy in CVE-2022-40011 | 11-Jul-23 -| - |Added Microsoft Defender Vulnerability Management support for Microsoft PowerBi Desktop | 13-Jul-23 -| - |Added zero-day details for CVE-2023-36884 | 12-Jul-23 -|26421 |D efender Vulnerability Management does not currently support assessment for ThinkCentre M75q Gen 2 & ThinkPad l390 Firmware| 14-Jul-23 -|23876 |Fixed inaccurate recommendation in Microsoft Teams CVE-2023-24881 | 20-Jul-23 -|25969 |Fixed inaccuracy in Siemens Sinec NMS | 24-Jul-23 -| - |Added EOS details for Windows Server 2012 & Windows Server 2012 R2 | 25-Jul-23 -|29096 | Fixed inaccurate detection of Slack version 1.0.0.0 | 25-Jul-23 -|27941 | Defender Vulnerability Management doesn't currently support assessment for Application Performance Management | 25-Jul-23 -|26116 | Fixed inaccuracy in HP CVEs: </br> CVE-2021-33159, CVE-2022-26845, CVE-2022-27497, CVE-2022-29893 | 27-Jul-23 -|25809 | Defender Vulnerability Management doesn't currently support assessment for Visio 2010, 2013, 2016 & 2019 | 31-Jul-23 -|25810 | Defender Vulnerability Management doesn't currently support assessment for Project 2019| 31-Jul-23 -|28176 | Fixed inaccuracy in VMWare Tools CVE-2021-31693 | 31-Jul-23 -|29089 | Fixed inaccuracy in CVE-2023-24329| 31-Jul-23 -|28489 | Fixed inaccuracy in CVE-2020-9484 | 31-Jul-23 -|28385 | Fixed inaccuracy in CVE-2023-28759| 31-Jul-23 +|24162 |Fixed inaccuracy in MYSQL Workbench| 04-Jul-23| +|25736 | Fixed inaccuracy in KeePass | 04-Jul-23| +|24598 | Fixed inaccuracy in Adobe Flash Player plugins |04-Jul-23| +| - |Lenovo CVEs not currently supported by Defender Vulnerability Management: </br> CVE-2021-3519, CVE-2021-22499, CVE-2021-22500, CVE-2021-22514| 03-Jul-23| +| - |Added Microsoft Defender Vulnerability Management support for Arcserve UDP | 05-Jul-23| +| - |Added accurate EOS details for Log4j versions| 05-Jul-23| +|27379 | Fixed inaccuracy in Adobe Animate | 06-Jul-23| +| - |Added Arcserve UDP affected product details in CVE-2023-26258 |05-Jul-23| +|26391 | Fixed inaccuracy in CVE-2020-26941 | 09-Jul-23| +|25245 | Fixed inaccuracy in CVE-2022-40011 | 11-Jul-23| +| - |Added Defender Vulnerability Management support for </br> Microsoft PowerBi Desktop | 13-Jul-23| +| - |Added zero-day details for CVE-2023-36884 | 12-Jul-23| +|26421 |Defender Vulnerability Management does not currently support: </br> ThinkCentre M75q Gen 2 & ThinkPad l390 Firmware| 14-Jul-23| +|23876 |Fixed inaccurate recommendation in Microsoft Teams CVE-2023-24881 | 20-Jul-23| +|25969 |Fixed inaccuracy in Siemens Sinec NMS | 24-Jul-23| +| - |Added EOS details for Windows Server 2012 & Windows Server 2012 R2 | 25-Jul-23| +|29096 | Fixed inaccurate detection of Slack version 1.0.0.0 | 25-Jul-23| +|27941 | Defender Vulnerability Management doesn't currently support </br> Application Performance Management| 25-Jul-23| +|26116 | Fixed inaccuracy in HP CVEs: </br> CVE-2021-33159, CVE-2022-26845, CVE-2022-27497, CVE-2022-29893 | 27-Jul-23| +|25809 | Defender Vulnerability Management doesn't currently support: </br> Visio 2010, 2013, 2016 & 2019 | 31-Jul-23| +|25810 | Defender Vulnerability Management doesn't currently support Project 2019| 31-Jul-23| +|28176 | Fixed inaccuracy in VMWare Tools CVE-2021-31693 | 31-Jul-23| +|29089 | Fixed inaccuracy in CVE-2023-24329| 31-Jul-23| +|28489 | Fixed inaccuracy in CVE-2020-9484 | 31-Jul-23| +|28385 | Fixed inaccuracy in CVE-2023-28759| 31-Jul-23| ## June 2023 Inaccuracy report ID |Description |Fix date | 22866 | Fixed normalization issue in dell optiplex_7470_ firmware | 29-Jun-23 + |
| security | Additional Information Xdr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/additional-information-xdr.md | Last updated 05/29/2023 To realize the benefits of Microsoft Defender Experts for XDR, you and your security operations center (SOC) team must take note of the following considerations to ensure timely incident remediation, improve your organization's security posture, and protect your organization from threats. - **Engage actively through the readiness assessment process** ΓÇô The [readiness assessment](get-started-xdr.md#run-initial-defender-experts-readiness-checks) when onboarding for Defender Experts for XDR is an integral part of the offering. Completing it successfully ensures prompt service coverage and protects your organization against known threats.-- **Act on guided responses in a timely manner** ΓÇô For any suspicious incidents and alerts, our experts provide a detailed investigation summary and guided responses for remediation. We expect your SOC team to act on these guided responses in a timely manner to prevent further impact from any malicious attempts.+- **Act on managed responses in a timely manner** ΓÇô For any suspicious incidents and alerts, our experts provide a detailed investigation summary and managed responses for remediation. We expect your SOC team to act on these managed responses in a timely manner to prevent further impact from any malicious attempts. - **Configure recommended settings and follow best practices to improve security posture** ΓÇô As part of our service, your service delivery manager and security analyst team share ongoing recommendations to strengthen your security posture. These recommendations are based on incidents investigated in your organization. Your SOC team should review these recommendations and implement them as soon as possible to protect your organization against future threats. ## Note about incident response |
| security | Dex Xdr Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/dex-xdr-overview.md | Defender Experts for XDR augments your SOC by combining automation and Microsoft - **Access expertise when you need it** - Extend your team's capacity with access to Defender Experts for assistance on an investigation - **Stay ahead of emerging threats** - Our experts proactively hunt for emerging threats in your environment, informed by unparalleled threat intelligence and visibility -In addition to the constantly updated research and intelligence tailored for the threats currently seen across the various Microsoft 365 Defender signals, you'll receive guided response from our security analysts and support from Microsoft's security-focused service delivery managers (SDMs). This service lets you enjoy the following capabilities: +In addition to the constantly updated research and intelligence tailored for the threats currently seen across the various Microsoft 365 Defender signals, you'll receive managed response from our security analysts and support from Microsoft's security-focused service delivery managers (SDMs). This service lets you enjoy the following capabilities: - **Managed detection and response** - Expert analysts manage your Microsoft 365 Defender incident queue and handle triage and investigation on your behalf; they partner with you and your team to take action or guide you to respond to incidents - **Proactive threat hunting** - [Microsoft Defender Experts for Hunting](../defender/defender-experts-for-hunting.md) is built in to extend your team's threat hunting capabilities and prioritize significant threats |
| security | Faq Incident Notifications Xdr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/faq-incident-notifications-xdr.md | + + Title: FAQs related to Microsoft Defender Experts for XDR incident notifications ++description: Frequently asked questions related to Defender Experts for XDR incident notifications +keywords: XDR, XDR incidents, Xtended detection and response, FAQ's related to XDR, defender experts for xdr, XDR incident notifications, defender experts analyst, managed threat hunting, managed detection and response (MDR) service, real-time visibility with XDR experts, DEX-XDR FAQ's +search.product: Windows 10 +++ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro ++ - m365-security + - tier1 ++search.appverid: met150 Last updated : 08/29/2023+++# Understanding and managing Defender Experts for XDR incident updates ++**Applies to:** ++- [Microsoft 365 Defender](microsoft-365-defender.md) ++The following section lists down questions your SOC team might have regarding the receipt of [incident notifications](start-using-mdex-xdr.md). ++## In Microsoft 365 Defender portal and Graph Security API ++| Questions | Answers | +||| +| **How do I know whether a Defender Experts analyst has started working on an incident?** | When a Defender Experts analyst starts working on an incident, the incident's **Assigned to** field is updated to _Defender Experts_.| +| **How do I know whether a Defender Experts analyst has resolved an incident?** | When a Defender Experts analyst has resolved an incident, the incident's **Status** field is updated to _Resolved_. | +| **How do I know what conclusion led a Defender Experts analyst to resolve an incident?** | When Defender Experts analysts resolve an incident, they modify the incident's **Classification** and **Determination** fields and provide a concise summary in its **Comments** section.<br><br>If an incident is classified as a True Positive, a comprehensive **Investigation summary** appears in the **Managed response** flyout panel in your Microsoft 365 Defender portal.| +| **How do I know what actions a Defender Experts analyst took in my tenant when investigating an incident?** | For each incident they investigate, the Defender Experts analyst summarizes any actions they performed within your tenant in the incident's **Investigation summary** located in the **Managed response** flyout panel in your Microsoft 365 Defender portal.<br><br>You can also retrieve information about these actions, and the times they signed into your tenant, by [searching your audit logs](/microsoft-365/security/defender/auditing#create-a-rule-for-email-notifications) either on the Microsoft Purview compliance portal or through the Office 365 Management Activity API.| +| **How do I know whether a Defender Experts analyst has sent any response actions for my SOC team?** | The Defender Experts analyst publishes the [response actions](/microsoft-365/security/defender/start-using-mdex-xdr#actions) they recommend your SOC team to perform on an incident in an incident's **Managed response** flyout panel in your Microsoft 365 Defender portal.<br><br>At this time, the incident's **Assigned to** field is updated to _Customer_ and its **Status** is updated to _Awaiting Customer Action_.<br><br>Your incident contacts, which you have [designated](/microsoft-365/security/defender/get-started-xdr#tell-us-who-to-contact-for-important-matters) in **Settings** > **Defender Experts** > **Notification contacts** in your Microsoft 365 Defender portal, also receive a corresponding email notification if there are response actions requiring your attention. | +| **How do I ask a Defender Experts analyst questions about an investigation or response action?** | After a Defender Experts analyst publishes their investigation summary and recommended response actions in the **Managed response** flyout panel of a True Positive incident, you can use the **Chat** tab in the same panel to ask the Defender Experts team questions about the incident and their investigation.<br><br>Alternatively, your designated incident contacts can directly respond to the email they received from Defender Experts to ask any questions you might have.| +| **How do I know which incidents have pending response actions?** | The Defender Experts card in your Microsoft 365 Defender portal home page includes a link that displays a message (for example, _3 incidents awaiting your action_). Selecting this link directs you to a filtered list of incidents specifically requiring your attention.<br><br>You can filter the incident queue in your Microsoft 365 Defender portal by selecting **Assigned to** as _Customer_ or **Status** as _Awaiting Customer Action_.| ++## In Microsoft Sentinel ++| Questions | Answers | +||| +| **How do I get Defender Experts updates in Sentinel?** | If you have enabled the data connector between Microsoft 365 Defender and Microsoft Sentinel, updates made by Defender Experts in Defender to incidents are synchronized with Microsoft Sentinel. [Learn more](/articles/sentinel/connect-microsoft-365-defender).<br><br>The **Assigned to**, **Status**, and **Classification** fields in Microsoft 365 Defender incidents are mapped to the corresponding fields in Sentinel, namely **Owner**, **Status**, and **Reason for closing**.| +| **How do I get Defender Experts updates in Sentinel to automatically trigger a playbook?** | To get Defender Experts updates, first, set up automation rules in Sentinel that are triggered with the following Defender Experts updates:<ul><li>When the **Owner** field in Microsoft Sentinel is updated to _Defender Experts_ or _Customer_.</li><li> When the **Status** field in Microsoft Sentinel is updated to _Active_ or _Closed_, which corresponds to Microsoft 365 Defender **Status** _Active_ and _In Progress_ respectively.</li><li>When Sentinel **Tag** _Awaiting Customer Action_ gets added, which corresponds to Microsoft 365 Defender **Status** _Awaiting Customer Action_.</li></ul>Next, set up playbooks in Microsoft Sentinel to automatically sync incident updates or [send incident notifications into other apps](/articles/sentinel/tutorial-respond-threats-playbook).<ul><li>Send email, or Teams message, or Slack message to your SOC team when a Defender Experts analyst is assigned to an incident.</li><li>Send SMS or phone call via Azure Communications Services or Twilio connector to your SOC lead when Defender Experts publishes response action for your team.</li><li>Create a task or ticket in apps such as Azure DevOps, ServiceNow, Jira, ZenDesk, FreshService, PagerDuty, etc. for your IT Ops team. </li></ul>| +| **How can I access managed response actions published by Defender Experts from Sentinel?** | Once Defender Experts publish managed response actions for an incident in your Microsoft 365 Defender portal, the **Owner** field is updated to _Customer_ automatically, and the tag _Awaiting Customer Action_ is available in Sentinel. You can use these field changes as a trigger to review the managed response panel for the corresponding incident in the Microsoft 365 Defender portal.| ++## In third-party SIEM, SOAR, or ITSM apps ++| Questions | Answers | +||| +| **How do I get Defender Experts updates from Microsoft 365 Defender to sync into third-party security information and event management (SIEM), security orchestration, automation and response (SOAR), or ITSM apps?** | You can get Defender Experts updates from Microsoft 365 Defender through the _Graph Security API_ ([_microsoft.graph.security.incident_](/graph/api/resources/security-incident).<br></br>To initiate the synchronization process:<ol><li>Establish the mapping between fields in Microsoft 365 Defender and the corresponding fields in the desired application. Determine whether the sync should be uni- or bi-directional and ensure that the other application supports that. <li>Develop, test, and deploy your sync integration. In most cases, it's recommended to periodically poll the Graph Security API every minute or so to check for updates.<li>Periodically validate that the field mapping is up to date.</ol>| +| **Can I sync managed response actions published by Defender Experts in Microsoft 365 Defender portal to third-party SIEM, SOAR, or ITSM apps?** | Once Defender Experts publish managed response actions for an incident in your Microsoft 365 Defender portal, the **Assigned to** field is changed to _Customer_ and the **Status** field is updated to _Awaiting Customer Action_. You can sync these fields via the Graph Security API and then use these changes as a trigger to review the managed response actions in the Microsoft 365 Defender portal.<br><br>Managed response actions are expected to be available in the Graph Security API later this year, at which time it will be possible to sync them with your third-party apps.| ++## In other communication services ++| Questions | Answers | +||| +| **Can I get Defender Experts updates from Microsoft 365 Defender in email?** | Once a Defender Experts analyst publishes recommended response actions to an incident, your designated incident contacts will receive a corresponding email notification to the email addresses specified in **Settings** > **Defender Experts** > **Notification contacts** in your Microsoft 365 Defender portal.<br><br>Additionally, you can [configure a Logic App](/connectors/connector-reference/connector-reference-logicapps-connectors) to send all incident updates to your designated email address(es) automatically.| +| **Can I get Defender Experts updates from Microsoft 365 Defender in Microsoft Teams?** | A two-way chat functionality is accessible through an incident's **Managed response** flyout panel in your Microsoft 365 Defender portal.<br><br>Additionally, you can [configure a Logic App](/connectors/connector-reference/connector-reference-logicapps-connectors) to send all incident updates to your designated email address(es) automatically.| +| **Can I get Defender Experts updates from Microsoft 365 Defender as SMS or phone call updates, or in third-party communications services such as Slack?** | You can [configure a Logic App](/connectors/connector-reference/connector-reference-logicapps-connectors) to do this to send notifications from communication services such as Slack, Twilio, Azure Communication Services, etc.| ++### See also ++[How Microsoft Defender Experts for XDR permissions work](dex-xdr-permissions.md) |
| security | Frequently Asked Questions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/frequently-asked-questions.md | -# Frequently asked questions +# General information on Defender Experts for XDR service **Applies to:** Last updated 05/29/2023 | **Does Defender Experts for XDR require Microsoft Sentinel?** | No. Defender Experts can use Microsoft 365 Defender data in customers' original locations for each Microsoft 365 Defender product deployed. | | **What products does Defender Experts for XDR operate on?** | Refer to the [Before you begin](before-you-begin-xdr.md) for details. | | **Does Defender Experts for XDR replace my SOC team?** | Defender Experts for XDR currently provide coverage for Microsoft 365 Defender incidents. It's the ideal way to augment your SOC team, reduce their workload, and collaborate with them to protect your organization from activity groups. |-| **What actions can your experts take during incident investigation?** | Our expert analysts can take actions based on the roles granted to them in your Microsoft 365 Defender portal. If our analysts are granted a security reader role, they can investigate and provide guided response for your SOC team to act on. If our analysts are granted a security operator role, they can also take specific remediation actions agreed upon with your SOC team. | +| **What actions can your experts take during incident investigation?** | Our expert analysts can take actions based on the roles granted to them in your Microsoft 365 Defender portal. If our analysts are granted a security reader role, they can investigate and provide managed response for your SOC team to act on. If our analysts are granted a security operator role, they can also take specific remediation actions agreed upon with your SOC team. | | **What types of incidents can your experts investigate?** | Defender Experts for XDR covers incidents categorized as High or Medium severity in Windows, Linux, and macOS devices. Incidents categorized as Compliance, Data Loss Prevention (DLP), or Custom Detections and those affecting internet of things (IoT), iOS, or Android devices are outside the service's scope. | | **Can your experts help me improve my security posture?** | Yes, our experts provide necessary guidance regularly to improve your security posture. | **Can Defender Experts for XDR help with an active compromise or vulnerability?** | No, Defender Experts currently don't provide incident response services. Contact your Microsoft representative or fill out the [Experiencing a Cybersecurity Incident?](https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbRypQlJUvhTFIvfpiAfrpFQdUOTdRRFpDUFQ1TzNLVFZXV0VUOVlVN0szUiQlQCN0PWcu) form to engage Microsoft Incident Response for incident response assistance. | |
| security | Get Started Xdr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/get-started-xdr.md | Defender Experts for XDR lets you determine the individuals or groups within you **To add notification contacts:** -1. In the same Defender Experts settings step-by-step guide, under **Incident contact**, search for and add your contact persons or teams that we can notify for guided response actions or any communication that requires a prompt response. +1. In the same Defender Experts settings step-by-step guide, under **Incident contact**, search for and add your contact persons or teams that we can notify for managed response actions or any communication that requires a prompt response. > [!NOTE] > Given the urgent nature of the communications, it is recommended to have someone available at all times. |
| security | Investigate Alerts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/investigate-alerts.md | As needed for in-process incidents, continue your [investigation](investigate-in - [Investigate incidents](investigate-incidents.md) - [Investigate data loss prevention alerts in Defender](dlp-investigate-alerts-defender.md) - [Azure Active Directory Identity Protection](/azure/active-directory/identity-protection/overview-identity-protection)-- + [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/defender-m3d-techcommunity.md)] |
| security | Manage Rbac | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/manage-rbac.md | Centralized permissions management is supported for the following solutions: |Microsoft Defender for Endpoint|Full support for all endpoint data and actions. All roles are compatible with the device group's scope as defined on the device groups page.| |Microsoft Defender Vulnerability Management | Centralized permissions management for all Defender Vulnerability Management capabilities.| |Microsoft Defender for Office 365|Support for all scenarios that were controlled by **Exchange Online Protection roles** (EOP), configured in the Microsoft 365 Defender portal under **Permissions** \> **Email & collaboration roles**. </br></br> **Note:** Scenarios that adhere to Exchange Online roles are not impacted by this new model and will still be managed by Exchange Online. The Microsoft 365 Defender RBAC model will initially be available for organizations with Microsoft Defender for Office Plan 2 licenses only. This capability is not available to users on trial licenses.|-|Microsoft for Identity|Full support for all identity data and actions. </br></br> **Note:** Defender for Identity experiences will also adhere to permissions granted from [Microsoft Defender for Cloud Apps](https://security.microsoft.com/cloudapps/permissions/roles). For more information, see [Microsoft Defender for Identity role groups](https://go.microsoft.com/fwlink/?linkid=2202729).| +|Microsoft Defender for Identity|Full support for all identity data and actions. </br></br> **Note:** Defender for Identity experiences will also adhere to permissions granted from [Microsoft Defender for Cloud Apps](https://security.microsoft.com/cloudapps/permissions/roles). For more information, see [Microsoft Defender for Identity role groups](https://go.microsoft.com/fwlink/?linkid=2202729).| |Microsoft Secure Score|Full support for all Secure Score data from the [Products included in Secure Score](../defender/microsoft-secure-score.md#products-included-in-secure-score).| - > [!NOTE] > Scenarios and experiences controlled by Compliance permissions are still managed in the Microsoft Purview compliance portal. > Use the following steps as a guide to start using the Microsoft 365 Defender Uni Watch the following video to see the steps above in action: > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RW12hyh]+ [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/defender-m3d-techcommunity.md)] |
| security | Start Using Mdex Xdr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/start-using-mdex-xdr.md | Once our experts begin to perform comprehensive response work on your behalf, yo ## Managed detection and response -Through a combination of automation and human expertise, Defender Experts for XDR triages Microsoft 365 Defender incidents, prioritizes them on your behalf, filters out the noise, carries out detailed investigations, and provides actionable guided response to your security operations center (SOC) teams. +Through a combination of automation and human expertise, Defender Experts for XDR triages Microsoft 365 Defender incidents, prioritizes them on your behalf, filters out the noise, carries out detailed investigations, and provides actionable managed response to your security operations center (SOC) teams. ### Incident notifications If an incident is classified as _False Positive_ or _Informational_, _Expected A Otherwise, if an incident is classified as _True Positive_, our experts then identify recommended response actions that need to be performed. The method in which the actions are performed depends on the permissions and access levels you have given the Defender Experts for XDR service. [Learn more about granting permissions to our experts](get-started-xdr.md#grant-permissions-to-our-experts). -- If you have granted Defender Experts for XDR the recommended Security Operator access permissions, our experts could perform the recommended response actions on the incident on your behalf. These actions, along with an **Investigation summary**, show up in the incident's [Guided response](#how-to-use-guided-response-in-microsoft-365-defender) flyout panel in your Microsoft 365 Defender portal for you or your SOC team to review. Once our experts conclude their work on the incident, its **Status** field is then updated to _Resolved_ and the **Assigned to** field is updated to _Unassigned_.+- If you have granted Defender Experts for XDR the recommended Security Operator access permissions, our experts could perform the recommended response actions on the incident on your behalf. These actions, along with an **Investigation summary**, show up in the incident's [Managed response](#how-to-use-managed-response-in-microsoft-365-defender) flyout panel in your Microsoft 365 Defender portal for you or your SOC team to review. Once our experts conclude their work on the incident, its **Status** field is then updated to _Resolved_ and the **Assigned to** field is updated to _Unassigned_. -- If you have granted Defender Experts for XDR the default Security Reader access, then the recommended response actions, along with an **Investigation summary**, show up in the incident's **Guided response** flyout panel in your Microsoft 365 Defender portal for you or your SOC team to perform. To identify this handover, the incident's **Assigned to** field is updated to _Customer_.+- If you have granted Defender Experts for XDR the default Security Reader access, then the recommended response actions, along with an **Investigation summary**, show up in the incident's **Managed response** flyout panel in your Microsoft 365 Defender portal for you or your SOC team to perform. To identify this handover, the incident's **Status** field is updated to _Awaiting Customer Action_ and **Assigned to** field is updated to _Customer_. You can check the number of incidents that are awaiting your action in the Defender Experts card in your Microsoft 365 Defender portal: To view the incidents our experts have investigated or are currently investigati :::image type="content" source="../../media/xdr/incidents-filter.png" alt-text="Screenshot of the Incidents queue in Microsoft 365 Defender portal filtered to only show those with the Defender Experts tag." lightbox="../../media/xdr/incidents-filter.png"::: -### How to use guided response in Microsoft 365 Defender +### How to use managed response in Microsoft 365 Defender -In the Microsoft 365 Defender portal, an incident that requires your attention using guided response has the **Assigned to** field set to _Customer_ and a task card on top of the **Incidents** pane. Your designated incident contacts also receives a corresponding email notification with a link to the Defender portal to view the incident. [Learn more about notification contacts](get-started-xdr.md#tell-us-who-to-contact-for-important-matters). +In the Microsoft 365 Defender portal, an incident that requires your attention using managed response has the **Assigned to** field set to _Customer_ and a task card on top of the **Incidents** pane. Your designated incident contacts also receives a corresponding email notification with a link to the Defender portal to view the incident. [Learn more about notification contacts](get-started-xdr.md#tell-us-who-to-contact-for-important-matters). -Select **View guided response** on the task card or on the top of the portal page (**Guided response** tab) to open a flyout panel where you can read our experts' investigation summary, complete pending actions identified by our experts, or engage with them through chat. -+Select **View managed response** on the task card or on the top of the portal page (**Managed response** tab) to open a flyout panel where you can read our experts' investigation summary, complete pending actions identified by our experts, or engage with them through chat. #### Investigation summary The **Investigation summary** section provides you with more context about the incident analyzed by our experts to provide you with visibility about its severity and potential impact if not addressed immediately. It could include the device timeline, indicators of attack and indicators of compromise (IOCs) observed, and other details. #### Actions The **Actions** tab displays task cards that contain response actions recommended by our experts. --Defender Experts for XDR currently supports the following one-click guided response actions: +Defender Experts for XDR currently supports the following one-click managed response actions: |**Action**|**Description**| ||--| |[Isolate device](/microsoft-365/security/defender-endpoint/respond-machine-alerts##isolate-devices-from-the-network)|Isolates a device, which helps prevent an attacker from controlling it and performing further activities such as data exfiltration and lateral movement. The isolated device will still be connected to Microsoft Defender for Endpoint.| |[Quarantine file](/microsoft-365/security/defender-endpoint/respond-file-alerts##stop-and-quarantine-files)|Stops running processes, quarantines the files, and deletes persistent data such as registry keys.| -Apart from these one-click actions, you can also receive guided responses from our experts that you need to perform manually. +Apart from these one-click actions, you can also receive managed responses from our experts that you need to perform manually. > [!NOTE]-> Before performing any of the recommended guided response actions, make sure that they are not already being addressed by your automated investigation and response configurations. [Learn more about automated investigation and response capabilities in Microsoft 365 Defender](m365d-autoir.md). +> Before performing any of the recommended managed response actions, make sure that they are not already being addressed by your automated investigation and response configurations. [Learn more about automated investigation and response capabilities in Microsoft 365 Defender](m365d-autoir.md). -**To view and perform the guided response actions:** +**To view and perform the managed response actions:** 1. Select the arrow buttons in a task card to expand it and read more information about the recommendation or collapse it. 1. For cards with one-click response actions, select the recommended action. The **Action status** in the card changes to **In progress**, then to **Failed** or **Completed**, depending on the action's outcome. Apart from these one-click actions, you can also receive guided responses from o The **Chat** tab provides you with a space in the Microsoft 365 Defender portal to engage with our experts and further understand the incident, our investigation, and the recommended actions we provided. You could ask about a malicious executable, malicious attachment, information about activity groups, advanced hunting queries, or any other information that would assist you with the incident resolution. - > [!NOTE]-> The chat option is only available for incidents where we issued guided response. +> The chat option is only available for incidents where we issued managed response. ## Get visibility to Defender Experts investigations in your SIEM or ITSM application You can get incident visibility in Microsoft Sentinel by turning on its out-of-t Once you have turned on the connector, updates by Defender Experts to the **Status**, **Assigned to**, **Classification**, and **Determination** fields in Microsoft 365 Defender will show up in the corresponding **Status**, **Owner**, and **Reason for closing** fields in Sentinel. > [!NOTE]-> The status of incidents in Microsoft 365 Defender typically transitions from _Active_ to _In progress_ to _Resolved_, while in Sentinel, it follows the _New_ to _Active_ to _Resolved_ path. +> The status of Defender Experts investigated incidents in Microsoft 365 Defender typically transitions from _Active_ to _In progress_ to _Awaiting Customer Action_, while in Sentinel, it follows the _New_ to _Active_ to _Resolved_ path. The Microsoft 365 Defender Status _Awaiting Customer Action_ does not have an equivalent field in Sentinel, instead a tag _Awaiting Customer Action_ is available in Sentinel.ΓÇ¥ The following section describes how an incident handled by our experts is updated in Sentinel as it progresses through the investigation journey: -1. An incident being investigated by our experts has the **Owner** listed as _Defender Experts_. -1. An incident that our experts have confirmed as a _True Positive_ has a guided response posted in Microsoft 365 Defender, and the **Owner** is listed as _Customer_. You need to act on the incident based on using the provided guided response. -1. Once our experts have concluded their investigation and closed an incident as _False Positive_ or _Informational_, _Expected Activity_, the incident's **Status** is updated to _Resolved_ and a **Reason for closing** is provided. +1. An incident being investigated by our experts has the **Status** listed as _Active_ and the **Owner** listed as _Defender Experts_. +1. An incident that our experts have confirmed as a _True Positive_ has a managed response posted in Microsoft 365 Defender, and a **Tag** _Awaiting Customer Action_ and the **Owner** is listed as _Customer_. You need to act on the incident based on using the provided managed response. +1. Once our experts have concluded their investigation and closed an incident as _False Positive_ or _Informational_, _Expected Activity_, the incident's **Status** is updated to _Resolved_, **Owner** is listed as _Customer_, and a **Reason for closing** is provided. :::image type="content" source="../../media/xdr/microsoft-sentinel-incidents.png" alt-text="Screenshot of Microsoft Sentinel incidents." lightbox="../../media/xdr/microsoft-sentinel-incidents.png"::: The topmost section of the Defender Experts for XDR report provides the percenta - **Investigated** ΓÇô The number of active threats and other incidents from your incident queue that we triaged, investigated, or currently investigating within our scope. - **Resolved** ΓÇô The total number of investigated incidents that were closed. - **Resolved directly** ΓÇô The number of investigated incidents that we were able to close directly on your behalf.-- **Resolved with your help** ΓÇô The number of investigated incidents that were resolved because of your action on one or more guided response tasks.+- **Resolved with your help** ΓÇô The number of investigated incidents that were resolved because of your action on one or more managed response tasks. The **Incidents by severity** and **Incidents by category** sections break down resolved incidents by severity and attack technique or threat type, respectively. These sections let you identify potential attack entry points and types of threats detected in your environment, assess their impact, and develop strategies to mitigate and prevent them. Select **View incidents** to get a filtered view of the incident queue based on the selections you made in each of the two sections. -The **Average incident resolution time** section displays a bar chart of the average time, in minutes, our experts spent investigating and closing incidents in your environment and the average time you spent performing the recommended guided response actions. +The **Average incident resolution time** section displays a bar chart of the average time, in minutes, our experts spent investigating and closing incidents in your environment and the average time you spent performing the recommended managed response actions. -If you've set Defender Experts for XDR to have **Security Reader** access, the **Average incident resolution time** section also displays the estimated **Potential time savings** you could realize if you let our experts take managed remediation actions on your behalf by [providing them the permissions](get-started-xdr.md#grant-permissions-to-our-experts) to do so. The potential time savings are derived by calculating the total time it took you to complete recommended guided response actions after our experts issued them to you during your selected date range. Otherwise, if the service has **Security Operator** access, this report section displays the estimated time you already saved by granting us permission to take managed remediation actions on your behalf. To change access levels, select **Edit permissions**. +If you've set Defender Experts for XDR to have **Security Reader** access, the **Average incident resolution time** section also displays the estimated **Potential time savings** you could realize if you let our experts take managed remediation actions on your behalf by [providing them the permissions](get-started-xdr.md#grant-permissions-to-our-experts) to do so. The potential time savings are derived by calculating the total time it took you to complete recommended managed response actions after our experts issued them to you during your selected date range. Otherwise, if the service has **Security Operator** access, this report section displays the estimated time you already saved by granting us permission to take managed remediation actions on your behalf. To change access levels, select **Edit permissions**. ## Collaborate with a trusted advisor |
| security | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/whats-new.md | You can also get product updates and important notifications through the [messag - Guides to responding to your first incident for new users are now live. [Understand incidents](respond-first-incident-365-defender.md) and learn to triage and prioritize, [analyze your first incident](respond-first-incident-analyze.md) using tutorials and videos, and [remediate attacks](respond-first-incident-remediate.md) by understanding actions available in the portal. - (Preview) [Asset rule management - Dynamic rules for devices](./configure-asset-rules.md) is now in public preview. Dynamic rules can help manage device context by assigning tags and device values automatically based on certain criteria. - (Preview) The [DeviceInfo](advanced-hunting-deviceinfo-table.md) table in advanced hunting now also includes the columns `DeviceManualTags` and `DeviceDynamicTags` in public preview to surface both manually and dynamically assigned tags related to the device you are investigating.+- The **Guided response** feature in Microsoft Defender Experts for XDR has been renamed to **[Managed response](start-using-mdex-xdr.md#how-to-use-managed-response-in-microsoft-365-defender)**. We have also added a [new FAQ section](faq-incident-notifications-xdr.md#understanding-and-managing-defender-experts-for-xdr-incident-updates) on incident updates. ## July 2023 - (GA) The [Attack story](investigate-incidents.md#attack-story) in incidents is now generally available. The attack story provides the full story of the attack and allows incident response teams to view the details and apply remediation. - A new URL and domain page is now available in Microsoft 365 Defender. The updated URL and domain page provides a single place to view all the information about a URL or a domain, including its reputation, the users who clicked it, the devices that accessed it, and emails where the URL or domain was seen. For details, see [Investigate URLs in Microsoft 365 Defender](/microsoft-365/security/defender-endpoint/investigate-domain). - ## June 2023 - (GA) Microsoft Defender Experts for XDR is now generally available. Defender Experts for XDR augments your security operations center by combining automation and Microsoft's security analyst expertise, helping you detect and respond to threats with confidence and improve your security posture. Microsoft Defender Experts for XDR is sold separately from other Microsoft 365 Defender products. If you're a Microsoft 365 Defender customer and are interested in purchasing Defender Experts for XDR, see [Overview of Microsoft Defender Experts for XDR](dex-xdr-overview.md). |
| security | Understand Overrides In Email Entity | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/understand-overrides-in-email-entity.md | + + Title: Understanding overrides within the email entity page in Microsoft Defender for Office 365 +description: Shows the different overrides in the email entity page in Microsoft Defender for Office 365 to help admins troubleshoot configurations. ++++++audience: ITPro +++- m365-guidance-templates +- m365-security +- tier3 Last updated : 08/14/2023+++# Understanding overrides within the email entity page in Microsoft Defender for Office 365 ++Within the Microsoft Defender for Office 365 *[email entity page](/microsoft-365/security/office-365-security/mdo-email-entity-page)*, there's a wealth of useful information about an email, including if applicable the **overrides** which affected that message, and potentially the location that the message was delivered or moved to post delivery. + +This article is all about helping you **understand the different overrides**, how they're triggered, and helpful information for diagnosing when the effect of an override was unexpected, such as an email being blocked when no threats were found. ++## Overrides details table ++The following table lists all overrides, a description of what that override means and some starting points for troubleshooting. Not all overrides are honored, depending on the circumstance. For example an email that contains malware is automatically blocked regardless if an end user set the sender as a "safe sender". To learn more about how overrides are applied see [this table](/microsoft-365/security/office-365-security/how-policies-and-protections-are-combined). ++| Override |Description|Notes| +| -- | -- | -- | +| Third Party Filter |We detected you're using a third party for your MX record and have an SCL-1 transport rule, overriding filtering and Secure by Default.|| +|Admin initiated time travel|Admin triggered investigation, which lead to zero-hour autopurge (ZAP) modifying the delivery location of messages.|| +|Antimalware policy block by file type|The file extension for an attachment within the message matched a banned file type listed in the anti-malware policy for the recipient|You may wish to tweak the file extensions listed in the Common attachments filter section of the anti-malware policy. change| +|Antispam policy settings|The message matched a custom option in the anti-spam policy for the recipient. For example: "SPF record: hard fail" or "Empty messages".|Check the "Mark as spam" options in the anti-spam policy for the affected recipient.| +|Connection policy|The message originated from an allowed / blocked IP within your connection filter policy.|Check the "Connection filter policy" within the anti-spam policies section of the security portal.| +|Exchange transport rule|The message matched a custom transport rule that affected the final delivery location.|You can use the email entity page, or Exchange message trace to highlight which transport rule was triggered.| +|Exclusive mode (User override)|The recipient has chosen to mark all messages as spam unless they're received from a sender in their trusted contact list.|The recipient has likely configured: "Don't trust email unless it comes from someone in my Safe Senders and Recipients list" within the Junk email settings in Outlook or OWA.| +|Filtering skipped due to on-premises organization|The message was marked as nonspam by your Exchange on-premises environment before being delivered to Exchange Online|You should review your on-premises environment to locate the source of the override.| +|IP region filter from policy|The message was detected as coming from a country/region that an admin has selected to block in the anti-spam policy for the recipient.|Modify the "From these countries/regions" option within the anti-spam policy applied to the affected recipient.| +|Language filter from policy|The message was detected as containing a language that an admin has selected to block in the anti-spam policy for the recipient.|Modify the "Contains specific languages" option within the anti-spam policy to the affected recipient.| +|Phishing simulation|The message met the criteria defined by an administrator to be considered a phishing simulation message.|Criteria are within the "Phishing simulation" tab within Advanced delivery in the security portal.| +|Quarantine release| The recipient or an administrator released this message from quarantine.|| +|SecOps Mailbox|The message was sent to the specific security operations mailbox defined by an administrator.|Mailboxes are defined within the "SecOps mailbox" tab within Advanced delivery in the security portal.| +|Sender address list (Admin Override)|The message matched an entry in the allowed/blocked senders within the anti-spam policy for the recipient.|Check the "Allowed and blocked senders and domains" section of the relevant anti-spam policy. (allows with this method aren't recommended).| +|Sender address list (User override)|The recipient has manually set this sender address to be delivered to the inbox (allowed) or junk email folder (blocked).|The recipient has likely configured "Safe senders and domains" or "Blocked senders and domains" within the Junk email settings in Outlook or OWA.| +|Sender domain list (Admin Override)|The message matched an entry in the allowed/blocked domains within the anti-spam policy for the recipient.|Check the "Allowed and blocked senders and domains" section of the relevant anti-spam policy. (allows with this method aren't recommended).| +|Sender domain list (User override)|The recipient has manually set the sending domain to be delivered to the inbox (allowed) or junk email folder (blocked).|The recipient has likely configured "Safe senders and domains" or "Blocked senders and domains" within the Junk email settings in Outlook or OWA.| +|Tenant Allow/Block List file|An entry was matched for a file hash listed in the Tenant allow/block list.|Review the entires within the "Tenant Allow/Block Lists" page within the security portal.| +|Tenant Allow/Block List sender email address|An entry was matched for a sender address listed in the Tenant allow/block list.|Review the entires within the "Tenant Allow/Block Lists" page within the security portal.| +|Tenant Allow/Block List spoof|An entry was matched for spoof detection in the Tenant allow/block list.|Review the entires within the "Tenant Allow/Block Lists" page within the security portal.| +|Tenant Allow/Block List URL| An entry was matched for a URL listed in the Tenant allow/block list.|Review the entires within the "Tenant Allow/Block Lists" page within the security portal.| +|Trusted contact list (User override)|The recipient has chosen to mark contacts in their contacts folder as trusted senders automatically.|The recipient has likely configured: "Trust email from my contacts" within the Junk email settings in Outlook or OWA.| +|Trusted domain (User override)|The recipient has added this domain to their safe recipients list within Outlook, emails sent to this domain aren't treated as junk email.|The recipient has likely configured "Safe Recipients" within Outlook's Junk email options.| +|Trusted recipient (User override)|The recipient has added this sender to their safe recipients list within Outlook, emails sent to this sender aren't treated as junk email.|The recipient has likely configured "Safe Recipients" within Outlook's Junk email options.| +|Trusted senders only (User override)|This override has same behavior as the Exclusive mode (User override), primarily used in outlook.com.|See "Exclusive mode (User override)"| +++## Next steps ++You can find a similar detailed table covering all the different detection technologies at [aka.ms/emailtech](/microsoft-365/security/office-365-security/step-by-step-guides/understand-detection-technology-in-email-entity). ++ |
| syntex | Content Processing Content Type | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/content-processing-content-type.md | -In Microsoft Syntex, you can create a rule to automatically set the content type for a file when it's added to a document library. +In Microsoft Syntex, you can create a rule to automatically set the content type for a file when it's added to a document library. ## Set a content type |
| syntex | Content Processing Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/content-processing-overview.md | For example, you can create a rule to move files tagged with a specific customer > [!NOTE] > This feature is available only for users who are licensed for Syntex. +## Syntex processing rules ++[Create a rule to move or copy a file from one document library to another](content-processing-create-rules.md) ++[Create a rule to set a content type when a file is added to a document library](content-processing-content-type.md) + ## Manage a rule 1. In the document library, select **Automate** > **Rules** > **Manage rules**. For example, you can create a rule to move files tagged with a specific customer 2. On the **Manage rules** page, you can see the rules that have been applied. You can turn on or off a rule or create a new rule to automate actions on a specific document library. -<! -## Syntex processing rules --[Create a rule to move or copy a file from one document library to another](content-processing-create-rules.md) --[Create a rule to set a content type when a file is added to a document library](content-processing-content-type.md)> |
| syntex | Ocr Preview Terms | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/ocr-preview-terms.md | + + Title: Microsoft Syntex Optical Character Recognition (ΓÇ£OCRΓÇ¥) Feature Preview Agreement ++++ Last updated : 08/29/2023+audience: admin ++++search.appverid: ++ms.localizationpriority: medium +description: Read the Microsoft Syntex Optical Character Recognition (ΓÇ£OCRΓÇ¥) Feature Preview Agreement. +++# Microsoft Syntex Optical Character Recognition (ΓÇ£OCRΓÇ¥) Feature Preview Agreement ++**<ins>The purpose of this Agreement</ins>**. We intend to enter discussions in which Company may provide input in connection with Microsoft offerings as described below. This Agreement clarifies our respective rights and obligations regarding that input. We agree that Company providing or Microsoft using input is voluntary. ++Input is all suggestions, comments, feedback, ideas, or know how, in any form, that Company provides to Microsoft. It doesn't include sales forecasts, financial results, future release scheduled, marketing plans and high-level product plans or feature lists for anticipated products. ++**MICROSOFT OFFERING:** ++The optical character recognition (OCR) service in Microsoft Syntex lets you extract printed or handwritten text from images, such as posters, drawings, and product labels, as well as from documents like articles, reports, forms, and invoices. Syntex OCR uses AI to extract text from customers' images, whether in OneDrive and SharePoint, Exchange emails, or Teams messages. This text extraction is done on a pay-as-you-go basis (each page of an image costs $0.001) using the latest tech fromΓÇ»Azure Cognitive Services. Global and SharePoint admins can configure Syntex OCR in theΓÇ»Microsoft Admin Center, and Compliance admins can also configure OCR in Microsoft Purview as they may need the capability for different scenarios and/or not want to leave Purview admin. The Syntex OCR service will honor settings from either admin experience, keeping the extracted text and not charging the customer twice even if it's configured in multiple places within admin. ++The OCR service supports more thanΓÇ»[150 languages](/azure/ai-services/language-support). ++**FEATURE PREVIEW:** Company agrees that by using this Preview Feature Company has accepted these terms. To terminate this Preview, don't use the Preview Feature. Microsoft may change or discontinue the Preview Feature at any time with or without notice. Microsoft may also choose not to make the Preview Feature generally commercially available. ++No SLA applies to this Feature Preview. ++THE PREVIEW FEATURE IS PROVIDED ΓÇ£AS-IS,ΓÇ¥ ΓÇ£WITH ALL FAULTS,ΓÇ¥ AND ΓÇ£AS AVAILABLE.ΓÇ¥ Microsoft provides no performance guarantee for the Feature Preview (including accompanying URLs provided for embedded or unauthenticated viewing) and Company bears the risk of using it. The Feature Preview isn't included in the SLA for Microsoft Syntex and may not be covered by customer support. ++**<ins>LICENSE</ins>** ++If Company provides Input, including feedback, Company grants to Microsoft, without charge, the nonexclusive License to make, modify, distribute, or otherwise commercialize the Input as part of any Microsoft offering. ++Company retains all right, title and interest in and to the Input. The above License doesn't extend to any technologies that may also be necessary to make or use any offering or portion thereof that incorporates the Input but aren't themselves expressly part of the Input (for example, enabling technologies). ++**<ins>PAYMENT TERMS</ins>** ++Syntex OCR services use pay-as-you-go billing through an Azure subscription. Syntex OCR services billing is determined the number of pages processed for images (JPEG, JPG, PNG, or BMP); the number of pages processed for PDF, TIF, or TIFF; or the number of embedded images in Teams chats and email messages. Each of these counts as one transaction. Processing occurs every time the file is edited. Company will be able to view this usage as meter events through the Azure subscription it chooses. ++Syntex OCR services Feature Preview pricing is as follows: ++|OCR Meters |Meter |Price | +|||--| +|Pages Processed |Optical character recognition (Preview) |$0.001/Transaction | ++Prerequisites to enable Syntex OCR services pay-as-you-go are: ++ (i) An Azure subscription with admin access as owner or contributor on the subscription;ΓÇ» ++ (ii) A SharePoint tenant ID; ++ (iii) An Azure resource group; ++ (iv) The ability to run PowerShell cmdlets to configure billing; and ++ (v) A Microsoft Entra appID in the same tenancy.ΓÇ» ++**<ins>INFORMATION USE AND DISCLOSURE</ins>** ++With respect to the Syntex OCR services, Microsoft may access or disclose information about Company, its account, and the content of its communications in order to: ++ a) provide, operate, and improve Microsoft services; ++ b) comply with the law or respond to lawful requests or legal process; or ++ c) protect the rights or property of Microsoft or our customers, including the enforcement of MicrosoftΓÇÖs agreements or policies governing the use of the Syntex OCR services. ++**<ins>Data Processing and Transfers</ins>** ++To the extent Microsoft is a processor of Personal Data subject to the European UnionΓÇÖs General Data Protection Regulation (ΓÇ£GDPRΓÇ¥), the GDPR Terms set forth in Attachment 1 govern that processing and the parties also agree to the following terms. For the purpose of this section, the term ΓÇ£Personal DataΓÇ¥ means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person: ++a) Processing Details. The parties acknowledge and agree that: ++ i. The subject-matter of the processing is limited to Personal Data within the scope of GDPR; ++ ii. The duration of the processing shall be for the duration of the CompanyΓÇÖs right to participate in the Feature Preview Program and until all Personal Data is deleted or returned in accordance with Company instructions or this Agreement; ++ iii. The nature and purpose of the processing shall be to provide the Syntex OCR services pursuant to the Agreement; ++ iv. The types of Personal Data processed by the Feature Preview Program include those expressly identified in Article 4 of the GDPR to the extent included by CompanyΓÇÖs data; and ++ v. The categories of data subjects are CompanyΓÇÖs representatives and end users, such as employees, contractors, collaborators, and customers. ++b) Data Transfers. ++ i. CompanyΓÇÖs data, and Personal Data that Microsoft processes on CustomerΓÇÖs behalf may be transferred to, and stored and processed in, the United States or any other country in which Microsoft or its Subprocessors operate. Company appoints Microsoft to perform any such transfer of Company data and Personal Data to any such country and to store and process data and Personal Data to provide the Syntex OCR services. ++ ii. Microsoft will abide by the requirements of European Economic Area and Swiss data protection law regarding the collection, use, transfer, retention and other processing of Personal Data from the European Economic Area and Switzerland. All transfers of Personal Data to a third country or an international organization will be subject to appropriate safeguards as described in Article 46 of the GDPR and such transfers and safeguards will be documented according to Article 30(2) of the GDPR. ++ iii. In addition, Microsoft is certified to meet the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks and the commitments they entail. Microsoft agrees to notify Company in the event that it determines that it can no longer meet its obligation to provide the same level of protection as is required by the Privacy Shield principles. ++**<ins>Acknowledgments and Consent by Company</ins>** ++If Company collects, stores, or processes Personal Data when using Syntex OCR services, Company agrees to comply with all privacy and data protection laws, taking into account the nature of the information to be processed, as well as the features and limitations of the Feature Preview Program as described in this Agreement or as otherwise provided to Company. ++**<ins>Pre-Release Service Features and Privacy Choice</ins>** ++Company affirms that it has obtained or will obtain any required consents from data subjects who may participate in CompanyΓÇÖs use of the Feature Preview Program. Company must not allow Personal Data to be collected through use of the Syntex OCR services in jurisdictions or industries where the Feature Preview attributes described herein would make such use contrary to applicable law. The Feature Preview may employ lesser or different security measures than those present in MicrosoftΓÇÖs existing commercial versions of Microsoft software or Online Services or expected to be present in future commercial versions of the software and Online Services. Without limiting the foregoing, security disclosures or independent security certifications applicable to existing commercial versions of the software and Online Services don't apply to the Feature Preview. ++**<ins>LENGTH OF OBLIGATIONS; DISCLOSURE</ins>** ++**Termination.** This Agreement continues in effect until <ins>December 31, 2023, or until the Preview Feature is generally commercially available to the public</ins>. Either of us may terminate this Agreement, or any input schedule, for any reason by 1) by Microsoft providing Company with 10 daysΓÇÖ advance notice, or 2) Company stops using the Preview Feature. Termination of this Agreement or any Input schedule won't change any of the rights, licenses granted, or duties made while this Agreement or input schedule is in effect. ++**Effects upon Termination.** Once terminated, Company will no longer use Syntex OCR services. ++This Agreement can't be extended. Microsoft may also choose not to make the Preview Feature generally commercially available. ++**Disclosure.** The Parties agree to keep confidential the terms of this Agreement and only disclose information to relevant parties limited to the extent necessary for the good execution of this Agreement, as well as the source of the Input. ++**Disclosing if required by law; or other action.** Each of us may disclose the confidential information described above if required to comply with a court order or other government demand that has the force of law or if in the context of an actual or threatened infringement or other action related to this Agreement or the Input. Before doing so, each of us must seek the highest level of protection available and, when possible, give the other enough prior notice to provide a reasonable chance to seek a protective order. ++**<ins>REPRESENTATIONS AND LIMITATIONS</ins>** ++**Input.** Company represents that it will not give any Input that: ++ 1. Violates any copyright or trade secret claim or right of any third party; ++ 2. It has reason to believe violates any patent claim or right of any third party; or ++ 3. Is subject to an excluded license. ++**Authority.** Company represents it has all rights and authority necessary to sign this Agreement and grant the rights in it for itself and its affiliates. ++**Limitations.** All information, materials and input are provided ΓÇ£as-isΓÇ¥ and Microsoft bears the risk of using them; Company gives no express warranties, guarantees or conditions as to its Input; and to the extent permitted under local law, Company excludes the implied warranties of merchantability, fitness for a particular purpose, title and non-infringement as to its Input. ++**<ins>LIMITATIONS ON AND EXCLUSIONS OF REMEDIES AND DAMAGES</ins>** ++Except as described herein, the only remedy either of us has for claims relating to this Agreement is to terminate it. Neither of us can recover any damages, including direct, consequential, lost profits, special, punitive, indirect or incidental damages from the other. This limitation applies: ++ 1. To claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law. ++ 2. Even if one of us knew or should have known about the possibility of the damages. ++The limitations in this section doesn't apply to claims arising from or in connection with any infringement, misuse or misappropriation by one of us of the otherΓÇÖs intellectual property rights. ++**<ins>GENERAL RIGHTS AND OBLIGATIONS</ins>** ++**Notices.** Notices may be provided either by electronic or physical mail. Each of us designates the persons specified on the last page of this Agreement to receive notices. Each of us may specify changes by giving notice to the other. ++**Law that applies; jurisdiction and venue.** The laws of the State of Washington govern this Agreement. If federal jurisdiction exists, each of us consents to exclusive jurisdiction and venue in the federal courts in King County, Washington. If not, each of us consents to exclusive jurisdiction and venue in the Superior Court of King County, Washington. ++**Waiver.** Any delay or failure of either of us to exercise a right or remedy won't result in a waiver of that, or any other, right or remedy. ++**Breach.** Each of us agrees that the other may seek court orders to stop any breach of this Agreement. ++**AttorneysΓÇÖ fees.** In any dispute relating to this Agreement the prevailing party will be entitled to recover reasonable attorneys' fees and costs. ++**No Assignment.** Neither of us may assign this Agreement, by operation of law, or otherwise, without the prior, written approval of the other. ++**Enforceability.** If any provision of this Agreement is unenforceable, the parties (or, if we can't agree, a court) will modify this Agreement to revise it so that it can be enforced. Even if no revision is possible, the rest of this Agreement will remain in place. ++**Entire Agreement.** This Agreement includes all exhibits and schedules. If Company has entered into a license agreement for use of any Microsoft offering, that license agreement will govern its use of the Microsoft offering, and any feedback given to Microsoft under that license agreement. With these exceptions, this is the entire agreement between us regarding the Input. It replaces all other agreements and understandings regarding the subject matter of this Agreement. ++               **Attachment 1 ΓÇô GDPR Terms** ++For purposes of these GDPR Terms, Company and Microsoft agree that Company is the controller of Personal Data and Microsoft is the processor of such data, except when Company acts as a processor of Personal Data, in which case Microsoft is a subprocessor. These GDPR Terms apply to the processing of Personal Data, within the scope of the GDPR, by Microsoft on behalf of Company. These GDPR Terms don't limit or reduce any data protection commitments Microsoft makes to Company in other agreements between Microsoft and Company. These GDPR Terms don't apply where Microsoft is a controller of Personal Data. ++**Relevant GDPR Obligations: Articles 28, 32, and 33** ++1) Microsoft shall not engage another processor without prior specific or general written authorization of Company. In the case of general written authorization, Microsoft shall inform Company of any intended changes concerning the addition or replacement of other processors, thereby giving Company the opportunity to object to such changes. (Article 28(2)) ++2) Processing by Microsoft shall be governed by these GDPR Terms under European Union (hereafter ΓÇ£UnionΓÇ¥) or Member State law and are binding on Microsoft with regard to Company. The subject-matter and duration of the processing, the nature and purpose of the processing, the type of Personal Data, the categories of data subjects and the obligations and rights of the Company are set forth in the Agreement, including these GDPR Terms. In particular, Microsoft shall: ++   a. process the Personal Data only on documented instructions from Company, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by Union or Member State law to which Microsoft is subject; in such a case, Microsoft shall inform Company of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; ++   b. ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; ++   c. take all measures required pursuant to Article 32 of the GDPR; ++   d. respect the conditions referred to in paragraphs 1 and 3 for engaging another processor; ++   e. taking into account the nature of the processing, assist Company by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the CompanyΓÇÖs obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR; ++   f. assist Company in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to Microsoft; ++   g. at the choice of Company, delete or return all the Personal Data to Company after the end of the provision of services relating to processing, and delete existing copies unless Union or Member State law requires storage of the Personal Data; ++   h. make available to Company all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by Company or another auditor mandated by Company. ++3) Microsoft shall immediately inform Company if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. (Article 28(3)) ++4) Where Microsoft engages another processor for carrying out specific processing activities on behalf of Company, the same data protection obligations as set out in these GDPR Terms shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR. Where that other processor fails to fulfill its data protection obligations, Microsoft shall remain fully liable to the Company for the performance of that other processor's obligations. (Article 28(4)) ++5) Taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Company and Microsoft shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: ++   a. the pseudonymization and encryption of Personal Data; ++   b. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; ++   c. the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and ++   d. a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing. (Article 32(1)) ++6) In assessing the appropriate level of security, account shall be taken of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored, or otherwise processed. (Article 32(2)) ++7) Company and Microsoft shall take steps to ensure that any natural person acting under the authority of Company or Microsoft who has access to Personal Data doesn't process them except on instructions from Company, unless he or she is required to do so by Union or Member State law. (Article 32(4)) ++8) Microsoft shall notify Company without undue delay after becoming aware of a Personal Data breach. (Article 33(2)). Such notification will include that information a processor must provide to a controller under Article 33(3) to the extent such information is reasonably available to Microsoft. |
| syntex | Ocr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/ocr.md | description: Learn how to set up and manage optical character recognition in Mic The optical character recognition (OCR) service for Microsoft Syntex is set up in the Microsoft 365 admin center. +Before you configure the OCR service, read the [Syntex OCR preview terms and conditions](ocr-preview-terms.md). + ## Prerequisites ### Licensing |