| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Remove Former Employee | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/remove-former-employee.md | After you remove a user, you have up to 30 days to restore their account. [Restore a user](restore-user.md) (article)\ [Add a new employee to Microsoft 365](add-new-employee.md) (article)\ [Assign licenses to users](../manage/assign-licenses-to-users.md) (article)\+[Remove-CalendarEvents](/powershell/module/exchange/remove-calendarevents)\ [Unassign licenses from users](../manage/remove-licenses-from-users.md) (article) |
| admin | Privacy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/adoption/privacy.md | To view the entire Adoption Score, you need be one of the following admin roles: Assign the Reports Reader or the Usage Summary Reports Reader role to anyone who's responsible for change management and adoption, but not necessarily an IT administrator. This role gives them access to the complete Adoption Score experience in the Microsoft 365 admin Center. -The Usage Summary Reports Reader role will have to be assigned through PowerShell cmdlets until it becomes assignable from the Microsoft 365 admin center later in 2020. --To assign the Usage Summary Reports Reader role with PowerShell: --- Run the following PowerShell:--```powershell -Connect-AzureAD -Enable-AzureADDirectoryRole -RoleTemplateId '75934031-6c7e-415a-99d7-48dbd49e875e' -$role=Get-AzureADDirectoryRole -Filter "roleTemplateId eq '75934031-6c7e-415a-99d7-48dbd49e875e'" -Get-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -$u=Get-AzureADUser -ObjectId <user upn> -Add-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -RefObjectId $u.ObjectId -``` - ## Capability to opt out of people experiences You can also opt out of the people experiences area of Adoption Score. If you opt out, no one from your organization will be able to view these metrics, and your organization will be removed from any calculations that involve communication, meetings, teamwork, content collaboration, and mobility. You have to be a Global admin to opt your organization out of the people experiences reports. You can also opt out of the people experiences area of Adoption Score. If you op To opt out: 1. In the admin center, go to **Settings** > **Org Settings** > **Adoption Score**.-2. Un-check the box that says **Allow Microsoft 365 usage data to be used for people experiences insights**. To understand how to modify data-sharing settings for Endpoint Analytics in the Intune configuration manager, select **Learn more**. -3. Select **Save**. +2. Select **No users (people experience insights wonΓÇÖt be calculated)**. +3. On the **Do you want to remove data from people experiences?** confirmation screen, select **Remove Data**. +4. Select **Save**. :::image type="content" source="../../media/orgsettingspageoptout.png" alt-text="Org settings page where you can opt out from people experiences."::: |
| compliance | Apply Sensitivity Label Automatically | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/apply-sensitivity-label-automatically.md | Use the following table to help you identify the differences in behavior for the |:--|:--|:--| |App dependency|Yes ([minimum versions](sensitivity-labels-office-apps.md#support-for-sensitivity-label-capabilities-in-apps)) |No \* | |Restrict by location|No |Yes |-|Conditions: Trainable classifiers|Yes |No | +|Conditions: Trainable classifiers|Yes |In preview | |Conditions: Sharing options and additional options for email|No |Yes | |Conditions: Exceptions|No |Yes (email only) | |Recommendations, policy tooltip, and user overrides|Yes |No | When this sensitivity label is automatically applied, the user sees a notificati ### Configuring sensitive info types for a label -When you select the **Sensitive info types** option, you see the same list of sensitive information types as when you create a data loss prevention (DLP) policy. So you can, for example, automatically apply a Highly Confidential label to any content that contains customers' personal information, such as credit card numbers, social security numbers, or passport numbers: +When you select the **Sensitive info types** option, you see the same list of [sensitive information types](sensitive-information-type-learn-about.md) as when you create a data loss prevention (DLP) policy. So you can, for example, automatically apply a Highly Confidential label to any content that contains customers' personal information, such as credit card numbers, social security numbers, or passport numbers:  Finally, you can use simulation mode to provide an approximation of the time nee 7. For the **Set up common or advanced rules** page: Keep the default of **Common rules** to define rules that identify content to label across all your selected locations. If you need different rules per location, including more options for Exchange, select **Advanced rules**. Then select **Next**. - The rules use conditions that include sensitive information types and sharing options: - - For sensitive information types, you can select both built-in and custom sensitive information types. - - For the shared options, you can choose **only with people inside my organization** or **with people outside my organization**. + The rules use conditions that include [sensitive information types](sensitive-information-type-learn-about.md), [trainable classifiers](classifier-learn-about.md), and sharing options: + - To select a sensitive information type or trainable classifier as a condition, under **Content contains**, select **Add**, and then choose **Sensitive info types** or **Trainable classifiers**. + - To select sharing options as a condition, under **Content is shared**, choose either **only with people inside my organization** or **with people outside my organization**. If your location is **Exchange** and you selected **Advanced rules**, there are other conditions that you can select: - Sender IP address is |
| compliance | Communication Compliance Channels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-channels.md | For private chat and private channels, communication compliance policies support | **Share a channel with an internal team** | Communication compliance policies apply to in-scope users and all messages in the shared channel | | **Share a channel with an external team** | Communication compliance policies apply to internal in-scope users and messages in the shared channel for the internal organization | -Modern attachments are files sourced from [OneDrive](/onedrive/plan-onedrive-enterprise#modern-attachments) or [SharePoint](/sharepoint/dev/solution-guidance/modern-experience-customizations) sites that are included in Teams messages. Text is automatically extracted from these attachments for automated processing and potential matches with active communication compliance policy conditions and classifiers. There isn't any additional configuration necessary for Modern attachment detection and processing. Text is only extracted for attachments matching policy conditions. Text isn't extracted for attachments for messages with policy matches, even if the attachment also has a policy match. +Modern attachments are files sourced from [OneDrive](/onedrive/plan-onedrive-enterprise#modern-attachments) or [SharePoint](/sharepoint/dev/solution-guidance/modern-experience-customizations) sites that are included in Teams messages. Text is automatically extracted from these attachments for automated processing and potential matches with active communication compliance policy conditions and classifiers. There isn't any additional configuration necessary for Modern attachment detection and processing. Text is only extracted for attachments matching policy conditions at the time the message was sent. Text isn't extracted for attachments for messages with policy matches, even if the attachment also has a policy match. Modern attachment scanning is supported for the following file types: |
| enterprise | During And After Your Data Move | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/during-and-after-your-data-move.md | Watch the Microsoft 365 Message Center for confirmation when moves for each of E |Germany <br/> |May 1, 2023 <br/> | |Brazil <br/> |June 1, 2023 <br/> | |Sweden <br/> |June 1, 2024 <br/> |+|Qatar <br/> |March 1, 2025 <br/> | ## Exchange Online |
| enterprise | Moving Data To New Datacenter Geos | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/moving-data-to-new-datacenter-geos.md | Existing customers that have their core customer data stored in an already exist |**Norway**| European Union | Norway | April 2020 | |**Brazil**| Americas | Brazil | November 2020 | |**Sweden**| European Union | Sweden | November 2021 |+|**Qatar**| European Union | Qatar | August 2022 | As of October 1, 2020 customers with an Office 365 Education subscription included in the tenant are not eligible for migration. |
| enterprise | O365 Data Locations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/o365-data-locations.md | Title: "Microsoft 365 data locations" Previously updated : 07/13/2022 Last updated : 08/30/2022 audience: ITPro New Microsoft 365 tenants are defaulted to Geo based on the country of the trans Find information about the contractual commitments for the storage location of customer data at rest in the [Microsoft Products and Services Data Protection Addendum (DPA)](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA). -For Azure Active Directory data locations, please visit [Data residency in Azure](https://azure.microsoft.com/global-infrastructure/data-residency/#overview). +For Azure Active Directory data locations, see [Data residency in Azure](https://azure.microsoft.com/global-infrastructure/data-residency/#overview). -If Customer's billing address is outside Europe and Customer has an Office 365 Education subscription, then notwithstanding the "Location of Customer Data at Rest for Core Online Services" section of the OST, Microsoft may provision Customer's Office 365 tenant in, transfer Customer Data to, and store Customer Data at rest anywhere within Europe or North America. If Customer's billing address is in Europe and Customer has an Office 365 Education subscription, then notwithstanding the "Location of Customer Data at Rest for Core Online Services" section of the OST, Microsoft may provision Customer's Office 365 tenant in, transfer Customer Data to, and store Customer Data at rest anywhere within the European Union. +If your billing address is outside Europe and you have an Office 365 Education subscription, then notwithstanding the "Location of Customer Data at Rest for Core Online Services" section of the OST, Microsoft may provision your Office 365 tenant in, transfer your data to, and store your data at rest anywhere within Europe or North America. If your billing address is in Europe and you have an Office 365 Education subscription, then notwithstanding the "Location of Customer Data at Rest for Core Online Services" section of the OST, Microsoft may provision your Office 365 tenant in, transfer your data to, and store your data at rest anywhere within the European Union. ## FAQ New Microsoft 365 tenants are defaulted to Geo based on the country of the billi | Viva learning | European Union | | Yammer | European Union | | Forms | United States |+ *Every service that stores customer data at rest in Exchange Online, SharePoint Online or OneDrive for Business, or is deployed locally. </p></details> |
| enterprise | Request Your Data Move | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/request-your-data-move.md | Eligible Microsoft 365 customers may request migration for their entire organiza |Norway | |Request period closed | |Germany | |Request period closed | |Brazil | |Request period closed |-|Sweden |November 16, 2021 |May 31, 2022 | +|Sweden | |Request period closed | +|Qatar |August 30, 2022 |February 28, 2023 | ## How to request a move |
| frontline | Deploy Teams At Scale | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/deploy-teams-at-scale.md | You use the ```New-CsBatchTeamsDeployment``` cmdlet to submit a batch of teams t Get-Command -Module MicrosoftTeams ``` - Verify that ```New-CsBatchTeamsDeployment``` and ```Get-CsBatchTeamsDeployment``` are listed. + Verify that ```New-CsBatchTeamsDeployment``` and ```Get-CsBatchTeamsDeploymentStatus``` are listed. 1. Run the following to deploy a batch of teams. In this command, you specify the path to your CSV files and the email addresses of up to five recipients to notify about this deployment. You use the ```New-CsBatchTeamsDeployment``` cmdlet to submit a batch of teams t 1. Run the following to check the status of the batch you submitted. ```powershell- Get-CsBatchTeamsDeployment -OrchestrationId "OrchestrationId" + Get-CsBatchTeamsDeploymentStatus -OrchestrationId "OrchestrationId" ``` ## Send us feedback |
| frontline | Flw Choose Scenarios | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/flw-choose-scenarios.md | Use these scenario overviews to start envisioning what your organization can do Communications solutions connect your frontline workers and allow them to collaborate with each other, with others in the organization, and with your customers. +Watch the following video to see an example of how you can help your frontline workers connect and collaborate in retail organizations: ++> [!VIDEO https://www.microsoft.com/videoplayer/embed/RWRJVw] ++ | Scenario | Description | Services | Teams apps | | | | | | | [Team communication and collaboration](flw-team-collaboration.md) | Help your frontline workforce communicate within their store, shift, or team with Microsoft Teams. Viva Connections helps you create a dashboard that puts the information they need front and center on their devices, so they can reach out whenever they need to. | Microsoft Teams<br>SharePoint<br>Viva Connections<br>Power Platform and Power Apps | Approvals, Chat, Files, Lists, Meet, Praise, Shifts, Tasks, Walkie Talkie | Simplify and streamline schedule coordination with your frontline workforce. Gai Drive operational efficiency by digitizing paper-based processes and automating routine, repetitive steps. +Watch the following video to see an example of how you can simplify business processes in retail environments: ++> [!VIDEO https://www.microsoft.com/videoplayer/embed/RWRzfc] ++ | Scenario | Description | Services | Teams apps | | | | | | | [Simplify business processes](simplify-business-processes.md) | Use task publishing to create standard processes across sites, lists to manage information and track ongoing processes, and streamline requests with Approvals. Automated workflows can speed up and automate actions, like collecting data or routing notifications. | Microsoft Teams<br>Power Platform | Tasks<br>Lists<br>Approvals | Drive operational efficiency by digitizing paper-based processes and automating Use Microsoft Bookings and Microsoft Teams to schedule and host virtual appointments with clients and customers. You can integrate Forms with your virtual appointments experience to get the right information about your customers, or as part of your customer support experience to learn what your customers need. +Watch the following video to see an example of virtual appointments in healthcare organizations: ++> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4TQop] ++ More information: [Virtual appointments with Microsoft Teams and the Bookings app](bookings-virtual-visits.md) ## Help your team, clients, and customers |
| frontline | Flw Corp Comms | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/flw-corp-comms.md | Keep your frontline team connected with your broader organization by using Yamme Engage and inform workers with Viva Connections. Viva Connections creates a hub in Teams where your frontline team can view a tailored news feed from your organization and a personalized dashboard with resources they need. When employees use Viva Connections, theyΓÇÖre able to get important information faster, meaning that managers donΓÇÖt have to spend valuable time relaying updates. Surface key information, personalized news, tasks, announcements, and other resources on the Viva Connections Dashboard. For example, a retailer could share new product and promotion announcements with their store associates, or a fundraising coordinator for a nonprofit could share quarterly goals with volunteers. - | View for a retail worker |View for a retail manager | | :- | :- | |  |  | - Learn more about [Viva Connections](/sharepoint/viva-connections-overview) and help your employees and associates get started with [Viva Connections in Microsoft Teams](https://support.microsoft.com/office/your-intranet-is-now-in-microsoft-teams-8b4e7f76-f305-49a9-b6d2-09378476f95b). With Microsoft Teams, Viva Connections, and SharePoint, you can enable these scenarios: |
| frontline | Simplify Business Processes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/simplify-business-processes.md | appliesto: You can use Teams apps, Power Apps, and Power BI to simplify business processes for your frontline teams. +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RWRzfc] ++ > [!NOTE] > Additional capabilities for [financial services](/industry/financial-services), [healthcare](/industry/healthcare), [nonprofit](/industry/nonprofit), and [retail](/industry/retail) environments are available with the Microsoft industry clouds, which include capabilities from Dynamics 365 and Microsoft Azure as well as the Microsoft 365 features. |
| frontline | Teams For Retail Landing Page | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/teams-for-retail-landing-page.md | Microsoft 365 and Microsoft Teams offer several capabilities that can help retai > [!NOTE] > These scenarios are also part of the Microsoft Cloud for Retail. You can do more with these scenarios when you also use other capabilities from the Microsoft Cloud for Retail, such as Microsoft Dynamics 365. Learn more about using this solution, which brings together capabilities from Azure, Dynamics 365, and Microsoft 365 at [Microsoft Cloud for Retail](/industry/retail). +Watch the following video to see how you can help your store associates connect and collaborate: ++> [!VIDEO https://www.microsoft.com/videoplayer/embed/RWRJVw] +++Watch the following video to see how you can simplify business processes in retail environments: ++> [!VIDEO https://www.microsoft.com/videoplayer/embed/RWRzfc] ++ ### In-store communication and collaboration Bring in-store associates and management together to collaborate and streamline operations with Teams and Teams apps. |
| includes | Change Library View | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/change-library-view.md | |
| includes | Improve Request Performance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/improve-request-performance.md | Title: Improve request performance description: Improve request performance keywords: server, request, performance search.product: eADQiWindows 10XVcnh+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| includes | Machineactionsnote | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/machineactionsnote.md | |
| includes | Microsoft Defender Api Usgov | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/microsoft-defender-api-usgov.md | Title: Microsoft Defender for Endpoint API URIs for US Government description: Microsoft Defender for Endpoint API URIs for US Government keywords: defender, endpoint, api, government, gov search.product: eADQiWindows 10XVcnh+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| includes | Microsoft Defender | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/microsoft-defender.md | |
| includes | Office 365 U.S. Government Dod Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/office-365-u.s.-government-dod-endpoints.md | <!--THIS FILE IS AUTOMATICALLY GENERATED. MANUAL CHANGES WILL BE OVERWRITTEN.--> <!--Please contact the Office 365 Endpoints team with any questions.--> -<!--USGovDoD endpoints version 2022062900--> -<!--File generated 2022-06-29 08:00:20.3239--> +<!--USGovDoD endpoints version 2022082900--> +<!--File generated 2022-08-30 08:00:06.2813--> ## Exchange Online ID | Category | ER | Addresses | Ports ID | Category | ER | Addresses | Ports -- | - | | - | - 11 | Allow<BR>Required | Yes | `*.dod.online.office365.us`<BR>`52.127.80.0/23, 52.181.164.39/32, 52.182.95.191/32` | **TCP:** 443-12 | Default<BR>Required | Yes | `*.dod.cdn.office365.us`<BR>`52.181.164.39/32, 52.182.95.191/32` | **TCP:** 443 +12 | Default<BR>Required | No | `*.office365.us` | **TCP:** 443, 80 13 | Allow<BR>Required | Yes | `*.auth.microsoft.us, *.gov.us.microsoftonline.com, dod-graph.microsoft.us, graph.microsoftazure.us, login.microsoftonline.us`<BR>`20.140.232.0/23, 52.126.194.0/23, 2001:489a:3500::/50` | **TCP:** 443 14 | Default<BR>Required | No | `*.msauth.net, *.msauthimages.us, *.msftauth.net, *.msftauthimages.us, clientconfig.microsoftonline-p.net, graph.windows.net, login.microsoftonline.com, login.microsoftonline-p.com, login.windows.net, loginex.microsoftonline.com, login-us.microsoftonline.com, mscrl.microsoft.com, nexus.microsoftonline-p.com, secure.aadcdn.microsoftonline-p.com` | **TCP:** 443 15 | Allow<BR>Required | Yes | `portal.apps.mil, reports.apps.mil, webshell.dodsuite.office365.us, www.ohome.apps.mil`<BR>`52.127.72.42/32, 52.127.76.42/32, 52.180.251.166/32, 52.181.24.112/32, 52.181.160.19/32, 52.181.160.113/32, 52.181.160.236/32, 52.182.24.200/32, 52.182.54.237/32, 52.182.92.132/32` | **TCP:** 443 |
| includes | Office 365 Worldwide Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/office-365-worldwide-endpoints.md | <!--THIS FILE IS AUTOMATICALLY GENERATED. MANUAL CHANGES WILL BE OVERWRITTEN.--> <!--Please contact the Office 365 Endpoints team with any questions.--> -<!--Worldwide endpoints version 2022072800--> -<!--File generated 2022-07-29 08:00:03.8046--> +<!--Worldwide endpoints version 2022082900--> +<!--File generated 2022-08-30 08:00:04.2649--> ## Exchange Online ID | Category | ER | Addresses | Ports | | | - | -- 1 | Optimize<BR>Required | Yes | `outlook.office.com, outlook.office365.com`<BR>`13.107.6.152/31, 13.107.18.10/31, 13.107.128.0/22, 23.103.160.0/20, 40.96.0.0/13, 40.104.0.0/15, 52.96.0.0/14, 131.253.33.215/32, 132.245.0.0/16, 150.171.32.0/22, 204.79.197.215/32, 2603:1006::/40, 2603:1016::/36, 2603:1026::/36, 2603:1036::/36, 2603:1046::/36, 2603:1056::/36, 2620:1ec:4::152/128, 2620:1ec:4::153/128, 2620:1ec:c::10/128, 2620:1ec:c::11/128, 2620:1ec:d::10/128, 2620:1ec:d::11/128, 2620:1ec:8f0::/46, 2620:1ec:900::/46, 2620:1ec:a92::152/128, 2620:1ec:a92::153/128, 2a01:111:f400::/48` | **TCP:** 443, 80 2 | Allow<BR>Required | Yes | `smtp.office365.com`<BR>`13.107.6.152/31, 13.107.18.10/31, 13.107.128.0/22, 23.103.160.0/20, 40.96.0.0/13, 40.104.0.0/15, 52.96.0.0/14, 131.253.33.215/32, 132.245.0.0/16, 150.171.32.0/22, 204.79.197.215/32, 2603:1006::/40, 2603:1016::/36, 2603:1026::/36, 2603:1036::/36, 2603:1046::/36, 2603:1056::/36, 2620:1ec:4::152/128, 2620:1ec:4::153/128, 2620:1ec:c::10/128, 2620:1ec:c::11/128, 2620:1ec:d::10/128, 2620:1ec:d::11/128, 2620:1ec:8f0::/46, 2620:1ec:900::/46, 2620:1ec:a92::152/128, 2620:1ec:a92::153/128, 2a01:111:f400::/48` | **TCP:** 587-3 | Default<BR>Required | No | `r1.res.office365.com, r3.res.office365.com, r4.res.office365.com` | **TCP:** 443, 80 5 | Allow<BR>Optional<BR>**Notes:** Exchange Online IMAP4 migration | Yes | `*.outlook.office.com, outlook.office365.com`<BR>`13.107.6.152/31, 13.107.18.10/31, 13.107.128.0/22, 23.103.160.0/20, 40.96.0.0/13, 40.104.0.0/15, 52.96.0.0/14, 131.253.33.215/32, 132.245.0.0/16, 150.171.32.0/22, 204.79.197.215/32, 2603:1006::/40, 2603:1016::/36, 2603:1026::/36, 2603:1036::/36, 2603:1046::/36, 2603:1056::/36, 2620:1ec:4::152/128, 2620:1ec:4::153/128, 2620:1ec:c::10/128, 2620:1ec:c::11/128, 2620:1ec:d::10/128, 2620:1ec:d::11/128, 2620:1ec:8f0::/46, 2620:1ec:900::/46, 2620:1ec:a92::152/128, 2620:1ec:a92::153/128, 2a01:111:f400::/48` | **TCP:** 143, 993 6 | Allow<BR>Optional<BR>**Notes:** Exchange Online POP3 migration | Yes | `*.outlook.office.com, outlook.office365.com`<BR>`13.107.6.152/31, 13.107.18.10/31, 13.107.128.0/22, 23.103.160.0/20, 40.96.0.0/13, 40.104.0.0/15, 52.96.0.0/14, 131.253.33.215/32, 132.245.0.0/16, 150.171.32.0/22, 204.79.197.215/32, 2603:1006::/40, 2603:1016::/36, 2603:1026::/36, 2603:1036::/36, 2603:1046::/36, 2603:1056::/36, 2620:1ec:4::152/128, 2620:1ec:4::153/128, 2620:1ec:c::10/128, 2620:1ec:c::11/128, 2620:1ec:d::10/128, 2620:1ec:d::11/128, 2620:1ec:8f0::/46, 2620:1ec:900::/46, 2620:1ec:a92::152/128, 2620:1ec:a92::153/128, 2a01:111:f400::/48` | **TCP:** 995-8 | Default<BR>Required | No | `*.outlook.com, attachments.office.net` | **TCP:** 443, 80 +8 | Default<BR>Required | No | `*.outlook.com` | **TCP:** 443, 80 9 | Allow<BR>Required | Yes | `*.protection.outlook.com`<BR>`40.92.0.0/15, 40.107.0.0/16, 52.100.0.0/14, 52.238.78.88/32, 104.47.0.0/17, 2a01:111:f403::/48` | **TCP:** 443 10 | Allow<BR>Required | Yes | `*.mail.protection.outlook.com`<BR>`40.92.0.0/15, 40.107.0.0/16, 52.100.0.0/14, 104.47.0.0/17, 2a01:111:f400::/48, 2a01:111:f403::/48` | **TCP:** 25 154 | Default<BR>Required | No | `autodiscover.<tenant>.onmicrosoft.com` | **TCP:** 443, 80 ID | Category | ER | Addresses | Ports ## SharePoint Online and OneDrive for Business ID | Category | ER | Addresses | Ports | -- | | - | --31 | Optimize<BR>Required | Yes | `<tenant>.sharepoint.com, <tenant>-my.sharepoint.com`<BR>`13.107.136.0/22, 40.108.128.0/17, 52.104.0.0/14, 104.146.128.0/17, 150.171.40.0/22, 2603:1061:1300::/40, 2620:1ec:8f8::/46, 2620:1ec:908::/46, 2a01:111:f402::/48` | **TCP:** 443, 80 +-- | -- | | -- | - +31 | Optimize<BR>Required | Yes | `*.sharepoint.com`<BR>`13.107.136.0/22, 40.108.128.0/17, 52.104.0.0/14, 104.146.128.0/17, 150.171.40.0/22, 2603:1061:1300::/40, 2620:1ec:8f8::/46, 2620:1ec:908::/46, 2a01:111:f402::/48` | **TCP:** 443, 80 32 | Default<BR>Optional<BR>**Notes:** OneDrive for Business: supportability, telemetry, APIs, and embedded email links | No | `ssw.live.com, storage.live.com` | **TCP:** 443 33 | Default<BR>Optional<BR>**Notes:** SharePoint Hybrid Search - Endpoint to SearchContentService where the hybrid crawler feeds documents | No | `*.search.production.apac.trafficmanager.net, *.search.production.emea.trafficmanager.net, *.search.production.us.trafficmanager.net` | **TCP:** 443 35 | Default<BR>Required | No | `*.wns.windows.com, admin.onedrive.com, officeclient.microsoft.com` | **TCP:** 443, 80 36 | Default<BR>Required | No | `g.live.com, oneclient.sfx.ms` | **TCP:** 443, 80 37 | Default<BR>Required | No | `*.sharepointonline.com, spoprod-a.akamaihd.net` | **TCP:** 443, 80-39 | Default<BR>Required | No | `*.gr.global.aa-rt.sharepoint.com, *.svc.ms, <tenant>-admin.sharepoint.com, <tenant>-files.sharepoint.com, <tenant>-myfiles.sharepoint.com` | **TCP:** 443, 80 +39 | Default<BR>Required | No | `*.svc.ms` | **TCP:** 443, 80 ## Skype for Business Online and Microsoft Teams ID | Category | ER | Addresses | Ports 18 | Default<BR>Optional<BR>**Notes:** Federation with Skype and public IM connectivity: Contact picture retrieval | No | `*.users.storage.live.com` | **TCP:** 443 19 | Default<BR>Optional<BR>**Notes:** Applies only to those who deploy the Conference Room Systems | No | `*.adl.windows.com` | **TCP:** 443, 80 22 | Allow<BR>Optional<BR>**Notes:** Teams: Messaging interop with Skype for Business | Yes | `*.skypeforbusiness.com`<BR>`13.107.64.0/18, 52.112.0.0/14, 52.120.0.0/14, 52.238.119.141/32, 52.244.160.207/32, 2603:1027::/48, 2603:1037::/48, 2603:1047::/48, 2603:1057::/48, 2603:1063::/38, 2620:1ec:6::/48, 2620:1ec:40::/42` | **TCP:** 443-26 | Default<BR>Required | No | `*.msedge.net, compass-ssl.microsoft.com` | **TCP:** 443 +26 | Default<BR>Optional<BR>**Notes:** Wildcard being moved to optional prior to being removed | No | `*.msedge.net` | **TCP:** 443 27 | Default<BR>Required | No | `*.mstea.ms, *.secure.skypeassets.com, mlccdnprod.azureedge.net` | **TCP:** 443 127 | Default<BR>Required | No | `*.skype.com` | **TCP:** 443, 80+180 | Default<BR>Required | No | `compass-ssl.microsoft.com` | **TCP:** 443 ## Microsoft 365 Common and Office Online ID | Category | ER | Addresses | Ports 44 | Default<BR>Optional<BR>**Notes:** Microsoft Stream - unauthenticated | No | `*.azureedge.net, *.media.azure.net, *.streaming.mediaservices.windows.net` | **TCP:** 443 45 | Default<BR>Optional<BR>**Notes:** Microsoft Stream | No | `*.keydelivery.mediaservices.windows.net` | **TCP:** 443 46 | Allow<BR>Required | Yes | `*.officeapps.live.com, *.online.office.com, office.live.com`<BR>`13.107.6.171/32, 13.107.18.15/32, 13.107.140.6/32, 52.108.0.0/14, 52.238.106.116/32, 52.244.37.168/32, 52.244.203.72/32, 52.244.207.172/32, 52.244.223.198/32, 52.247.150.191/32, 2603:1010:2::cb/128, 2603:1010:200::c7/128, 2603:1020:200::682f:a0fd/128, 2603:1020:201:9::c6/128, 2603:1020:600::a1/128, 2603:1020:700::a2/128, 2603:1020:800:2::6/128, 2603:1020:900::8/128, 2603:1030:7::749/128, 2603:1030:800:5::bfee:ad3c/128, 2603:1030:f00::17/128, 2603:1030:1000::21a/128, 2603:1040:200::4f3/128, 2603:1040:401::762/128, 2603:1040:601::60f/128, 2603:1040:a01::1e/128, 2603:1040:c01::28/128, 2603:1040:e00:1::2f/128, 2603:1040:f00::1f/128, 2603:1050:1::cd/128, 2620:1ec:c::15/128, 2620:1ec:8fc::6/128, 2620:1ec:a92::171/128, 2a01:111:f100:2000::a83e:3019/128, 2a01:111:f100:2002::8975:2d79/128, 2a01:111:f100:2002::8975:2da8/128, 2a01:111:f100:7000::6fdd:6cd5/128, 2a01:111:f100:a004::bfeb:88cf/128` | **TCP:** 443, 80-47 | Default<BR>Required | No | `*.cdn.office.net, contentstorage.osi.office.net` | **TCP:** 443 +47 | Default<BR>Required | No | `*.office.net` | **TCP:** 443, 80 49 | Default<BR>Required | No | `*.onenote.com` | **TCP:** 443-50 | Default<BR>Optional<BR>**Notes:** OneNote notebooks (wildcards) | No | `*.microsoft.com, *.office.net` | **TCP:** 443 +50 | Default<BR>Optional<BR>**Notes:** OneNote notebooks (wildcards) | No | `*.microsoft.com` | **TCP:** 443 51 | Default<BR>Required | No | `*cdn.onenote.net` | **TCP:** 443 53 | Default<BR>Required | No | `ajax.aspnetcdn.com, apis.live.net, officeapps.live.com, www.onedrive.com` | **TCP:** 443 56 | Allow<BR>Required | Yes | `*.auth.microsoft.com, *.msftidentity.com, *.msidentity.com, account.activedirectory.windowsazure.com, accounts.accesscontrol.windows.net, adminwebservice.microsoftonline.com, api.passwordreset.microsoftonline.com, autologon.microsoftazuread-sso.com, becws.microsoftonline.com, ccs.login.microsoftonline.com, clientconfig.microsoftonline-p.net, companymanager.microsoftonline.com, device.login.microsoftonline.com, graph.microsoft.com, graph.windows.net, login.microsoft.com, login.microsoftonline.com, login.microsoftonline-p.com, login.windows.net, logincert.microsoftonline.com, loginex.microsoftonline.com, login-us.microsoftonline.com, nexus.microsoftonline-p.com, passwordreset.microsoftonline.com, provisioningapi.microsoftonline.com`<BR>`20.190.128.0/18, 40.126.0.0/18, 2603:1006:2000::/48, 2603:1007:200::/48, 2603:1016:1400::/48, 2603:1017::/48, 2603:1026:3000::/48, 2603:1027:1::/48, 2603:1036:3000::/48, 2603:1037:1::/48, 2603:1046:2000::/48, 2603:1047:1::/48, 2603:1056:2000::/48, 2603:1057:2::/48` | **TCP:** 443, 80 59 | Default<BR>Required | No | `*.hip.live.com, *.microsoftonline.com, *.microsoftonline-p.com, *.msauth.net, *.msauthimages.net, *.msecnd.net, *.msftauth.net, *.msftauthimages.net, *.phonefactor.net, enterpriseregistration.windows.net, management.azure.com, policykeyservice.dc.ad.msft.net` | **TCP:** 443, 80 64 | Allow<BR>Required | Yes | `*.compliance.microsoft.com, *.protection.office.com, *.security.microsoft.com, compliance.microsoft.com, defender.microsoft.com, protection.office.com, security.microsoft.com`<BR>`52.108.0.0/14, 2603:1006:1400::/40, 2603:1016:2400::/40, 2603:1026:2400::/40, 2603:1036:2400::/40, 2603:1046:1400::/40, 2603:1056:1400::/40, 2a01:111:200a:a::/64, 2a01:111:2035:8::/64, 2a01:111:f406:1::/64, 2a01:111:f406:c00::/64, 2a01:111:f406:1004::/64, 2a01:111:f406:1805::/64, 2a01:111:f406:3404::/64, 2a01:111:f406:8000::/64, 2a01:111:f406:8801::/64, 2a01:111:f406:a003::/64` | **TCP:** 443 65 | Allow<BR>Required | Yes | `account.office.net`<BR>`52.108.0.0/14, 2603:1006:1400::/40, 2603:1016:2400::/40, 2603:1026:2400::/40, 2603:1036:2400::/40, 2603:1046:1400::/40, 2603:1056:1400::/40, 2a01:111:200a:a::/64, 2a01:111:2035:8::/64, 2a01:111:f406:1::/64, 2a01:111:f406:c00::/64, 2a01:111:f406:1004::/64, 2a01:111:f406:1805::/64, 2a01:111:f406:3404::/64, 2a01:111:f406:8000::/64, 2a01:111:f406:8801::/64, 2a01:111:f406:a003::/64` | **TCP:** 443, 80-66 | Default<BR>Required | No | `*.portal.cloudappsecurity.com, suite.office.net` | **TCP:** 443 +66 | Default<BR>Required | No | `*.portal.cloudappsecurity.com` | **TCP:** 443 67 | Default<BR>Optional<BR>**Notes:** Security and Compliance Center eDiscovery export | No | `*.blob.core.windows.net` | **TCP:** 443 68 | Default<BR>Optional<BR>**Notes:** Portal and shared: 3rd party office integration. (including CDNs) | No | `firstpartyapps.oaspapps.com, prod.firstpartyapps.oaspapps.com.akadns.net, telemetryservice.firstpartyapps.oaspapps.com, wus-firstpartyapps.oaspapps.com` | **TCP:** 443 69 | Default<BR>Required | No | `*.aria.microsoft.com, *.events.data.microsoft.com` | **TCP:** 443-70 | Default<BR>Required | No | `*.o365weve.com, amp.azure.net, appsforoffice.microsoft.com, assets.onestore.ms, auth.gfx.ms, c1.microsoft.com, dgps.support.microsoft.com, docs.microsoft.com, msdn.microsoft.com, platform.linkedin.com, prod.msocdn.com, shellprod.msocdn.com, support.content.office.net, support.microsoft.com, technet.microsoft.com, videocontent.osi.office.net, videoplayercdn.osi.office.net` | **TCP:** 443 -71 | Default<BR>Required | No | `*.office365.com` | **TCP:** 443 +70 | Default<BR>Required | No | `*.o365weve.com, amp.azure.net, appsforoffice.microsoft.com, assets.onestore.ms, auth.gfx.ms, c1.microsoft.com, dgps.support.microsoft.com, docs.microsoft.com, msdn.microsoft.com, platform.linkedin.com, prod.msocdn.com, shellprod.msocdn.com, support.microsoft.com, technet.microsoft.com` | **TCP:** 443 +71 | Default<BR>Required | No | `*.office365.com` | **TCP:** 443, 80 72 | Default<BR>Optional<BR>**Notes:** Azure Rights Management (RMS) with Office 2010 clients | No | `*.cloudapp.net` | **TCP:** 443 73 | Default<BR>Required | No | `*.aadrm.com, *.azurerms.com, *.informationprotection.azure.com, ecn.dev.virtualearth.net, informationprotection.hosting.portal.azure.net` | **TCP:** 443 75 | Default<BR>Optional<BR>**Notes:** Graph.windows.net, Office 365 Management Pack for Operations Manager, SecureScore, Azure AD Device Registration, Forms, StaffHub, Application Insights, captcha services | No | `*.sharepointonline.com, dc.services.visualstudio.com, mem.gfx.ms, staffhub.ms` | **TCP:** 443-78 | Default<BR>Optional<BR>**Notes:** Some Office 365 features require endpoints within these domains (including CDNs). Many specific FQDNs within these wildcards have been published recently as we work to either remove or better explain our guidance relating to these wildcards. | No | `*.microsoft.com, *.msocdn.com, *.office.net, *.onmicrosoft.com` | **TCP:** 443, 80 +78 | Default<BR>Optional<BR>**Notes:** Some Office 365 features require endpoints within these domains (including CDNs). Many specific FQDNs within these wildcards have been published recently as we work to either remove or better explain our guidance relating to these wildcards. | No | `*.microsoft.com, *.msocdn.com, *.onmicrosoft.com` | **TCP:** 443, 80 79 | Default<BR>Required | No | `o15.officeredir.microsoft.com, officepreviewredir.microsoft.com, officeredir.microsoft.com, r.office.microsoft.com` | **TCP:** 443, 80 83 | Default<BR>Required | No | `activation.sls.microsoft.com` | **TCP:** 443 84 | Default<BR>Required | No | `crl.microsoft.com` | **TCP:** 443, 80 86 | Default<BR>Required | No | `office15client.microsoft.com, officeclient.microsoft.com` | **TCP:** 443-88 | Default<BR>Required | No | `insertmedia.bing.office.net` | **TCP:** 443, 80 89 | Default<BR>Required | No | `go.microsoft.com` | **TCP:** 443, 80 91 | Default<BR>Required | No | `ajax.aspnetcdn.com, cdn.odc.officeapps.live.com` | **TCP:** 443, 80 92 | Default<BR>Required | No | `officecdn.microsoft.com, officecdn.microsoft.com.edgesuite.net` | **TCP:** 443, 80 ID | Category | ER | Addresses | Ports 124 | Default<BR>Optional<BR>**Notes:** Sway | No | `sway.com, www.sway.com` | **TCP:** 443 125 | Default<BR>Required | No | `*.entrust.net, *.geotrust.com, *.omniroot.com, *.public-trust.com, *.symcb.com, *.symcd.com, *.verisign.com, *.verisign.net, apps.identrust.com, cacerts.digicert.com, cert.int-x3.letsencrypt.org, crl.globalsign.com, crl.globalsign.net, crl.identrust.com, crl3.digicert.com, crl4.digicert.com, isrg.trustid.ocsp.identrust.com, mscrl.microsoft.com, ocsp.digicert.com, ocsp.globalsign.com, ocsp.msocsp.com, ocsp2.globalsign.com, ocspx.digicert.com, secure.globalsign.com, www.digicert.com, www.microsoft.com` | **TCP:** 443, 80 126 | Default<BR>Optional<BR>**Notes:** Connection to the speech service is required for Office Dictation features. If connectivity is not allowed, Dictation will be disabled. | No | `officespeech.platform.bing.com` | **TCP:** 443-128 | Default<BR>Required | No | `*.config.office.net, *.manage.microsoft.com` | **TCP:** 443 +128 | Default<BR>Required | No | `*.manage.microsoft.com` | **TCP:** 443 147 | Default<BR>Required | No | `*.office.com` | **TCP:** 443, 80 148 | Default<BR>Required | No | `cdnprod.myanalytics.microsoft.com, myanalytics.microsoft.com, myanalytics-gcc.microsoft.com` | **TCP:** 443, 80-149 | Default<BR>Required | No | `workplaceanalytics.cdn.office.net` | **TCP:** 443, 80 152 | Default<BR>Optional<BR>**Notes:** These endpoints enables the Office Scripts functionality in Office clients available through the Automate tab. This feature can also be disabled through the Office 365 Admin portal. | No | `*.microsoftusercontent.com` | **TCP:** 443 153 | Default<BR>Required | No | `*.azure-apim.net, *.flow.microsoft.com, *.powerapps.com` | **TCP:** 443 156 | Default<BR>Required | No | `*.activity.windows.com, activity.windows.com` | **TCP:** 443 |
| includes | Prerelease | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/prerelease.md | |
| includes | Security Config Mgt Prerequisites | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/security-config-mgt-prerequisites.md | Title: include file description: include file -+ When a device that is domain joined creates a trust with Azure Active Directory, - Azure Active Directory Connect (AAD Connect) must be synchronized to the tenant that is used from Microsoft Defender for Endpoint - Hybrid Azure Active Directory Join must be configured in your environment (either through Federation or AAD Connect Sync) - AAD Connect Sync must include the device objects *in scope* for synchronization with Azure Active Directory (when needed for join)-- AAD Connect rules for sync [must be modified for Server 2012 R2](/microsoft-365/security/defender-endpoint/troubleshoot-security-config-mgt?view=o365-worldwide#instructions-for-applying-computer-join-rule-in-aad-connect) (when support for Server 2012 R2 is needed)+- AAD Connect rules for sync [must be modified for Server 2012 R2](/microsoft-365/security/defender-endpoint/troubleshoot-security-config-mgt#instructions-for-applying-computer-join-rule-in-aad-connect) (when support for Server 2012 R2 is needed) - All devices must register in the Azure Active Directory of the tenant that hosts Microsoft Defender for Endpoint. Cross-tenant scenarios are not supported. ### Connectivity Requirements |
| lighthouse | M365 Lighthouse Block User Signin | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-block-user-signin.md | You can block a user account if you think it's compromised. When you block a use ## Block sign-in for a user -1. In the left navigation pane in Lighthouse, select **Users** > **Search users**. +1. In the left navigation pane in Lighthouse, select **Users** > **Account management** >**Search users**. 2. On the **Search users** tab, enter a user's name in the search box. You can block a user account if you think it's compromised. When you block a use 1. In the left navigation pane in Lighthouse, select **Users** > **Risky users**. -2. On the **Risky Users** tab, select the set of users you want to take action on. +2. On the **Risky Users** page, select the set of users you want to take action on. 3. Select **Block sign-in**. |
| lighthouse | M365 Lighthouse Manage Inactive Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-manage-inactive-users.md | + + Title: "Manage inactive users in Microsoft 365 Lighthouse" +f1.keywords: NOCSH +++++audience: Admin ++ms.localizationpriority: medium ++- M365-subscription-management +- Adm_O365 ++- AdminSurgePortfolio +- M365-Lighthouse +search.appverid: MET150 +description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthouse, learn how to manage inactive users." +++# Manage inactive users in Microsoft 365 Lighthouse ++Microsoft 365 Lighthouse provides visibility into all the users across your managed tenants that have been inactive for over six months. Inactive accounts may present security risks and tie up unused licenses. From the **Inactive users** page, you can track and clean up inactive accounts. ++Lighthouse uses sign-in activity to detect inactive users accounts. The **Inactive users** page shows up to 500 inactive accounts for each tenant. ++## Review inactive users ++1. In the left navigation pane in Lighthouse, select **Users** > **Account management > Inactive users**. ++2. On the **Inactive Users** tab, set filters to the desired result. ++3. From the list of tenants, expand any tenant to see a list of inactive users within the tenant. ++4. Select any user to open the user details pane and see more information about the account. ++5. Once youΓÇÖve determined that a user account is no longer needed, you can delete or block the account. At the minimum, you should block the user account to reduce security risks. From the user details pane, select **Block sign-in** or **Delete user**. ++## Block sign-in for multiple user accounts ++1. In the left navigation pane in Lighthouse, select **Users** > **Account management >** **Inactive users**. ++2. On the **Inactive users** tab, expand any tenant in the list to see a list of inactive users within the tenant, select the users you want to block, and then select **Block sign-in**. ++3. In the **Manage sign-in status** pane, select **Block users from signing in**. ++4. Select **Save**. ++## Related content ++[How to manage inactive user accounts in Azure AD](/azure/active-directory/reports-monitoring/howto-manage-inactive-user-accounts) (article) |
| lighthouse | M365 Lighthouse Manage Mfa | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-manage-mfa.md | description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthous # Manage multifactor authentication in Microsoft 365 Lighthouse -Azure Active Directory (Azure AD) Multi-Factor Authentication (MFA) helps safeguard access to data and applications, providing another layer of security by using a second form of authentication. The Multifactor Authentication tab provides detailed information on the status of MFA enablement across your tenants. Select any tenant in the list to see more details for that tenant, including which Conditional Access policies requiring MFA are already configured and which users haven't yet registered for MFA. +Azure Active Directory (Azure AD) Multi-Factor Authentication (MFA) helps safeguard access to data and applications, providing another layer of security by using a second form of authentication. The Multifactor Authentication page provides detailed information on the status of MFA enablement across your tenants. Select any tenant in the list to see more details for that tenant, including which Conditional Access policies requiring MFA are already configured and which users haven't yet registered for MFA. For small- and medium-sized business (SMB) customers, Microsoft recommends enabling [security defaults](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults) at a minimum. For more complex scenarios, you can use [Conditional Access](/azure/active-directory/conditional-access/overview) to configure specific policies. The following conditions must be met before a tenant will appear in the list: 1. In the left navigation pane in Lighthouse, select **Users** > **Multifactor authentication**. -2. On the **Multifactor Authentication** tab, look for a tenant currently not using MFA, and then select that tenant to open the tenant details pane. +2. On the **Multifactor Authentication** page, look for a tenant currently not using MFA, and then select that tenant to open the tenant details pane. 3. On the **MFA enablement** tab, under **MFA with Security defaults**, select **Enable Security defaults**. To enable MFA through Conditional Access, see [Tutorial: Secure user sign-in eve 1. In the left navigation pane in Lighthouse, select **Users** > **Multifactor authentication**. -2. On the **Multifactor Authentication** tab, look for tenants with users not registered for MFA, and then select the tenant to open the tenant details pane. +2. On the **Multifactor Authentication** page, look for tenants with users not registered for MFA, and then select the tenant to open the tenant details pane. 3. Select **Users not registered for MFA** tab. |
| lighthouse | M365 Lighthouse Manage Sspr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-manage-sspr.md | The following conditions must be met before a tenant will appear in the list: - In the left navigation pane in Lighthouse, select **Users** > **Password reset**. -The Password reset tab provides an overview of the tenants that have enabled SSPR through the recommended settings, the number of users who haven't registered for SSPR, and a detailed breakdown by tenant of the SSPR deployment progress across the organizations that you manage. +The Password reset page provides an overview of the tenants that have enabled SSPR through the recommended settings, the number of users who haven't registered for SSPR, and a detailed breakdown by tenant of the SSPR deployment progress across the organizations that you manage. ## Enable SSPR for a tenant 1. In the left navigation pane in Lighthouse, select **Users** > **Password reset**. -2. On the **Password reset** tab, select a tenant from the list to open the details pane. +2. On the **Password reset** page, select a tenant from the list to open the details pane. 3. Select **Edit SSPR settings in Azure Active Directory** to go to Azure Active Directory (Azure AD). The Password reset tab provides an overview of the tenants that have enabled SSP 1. In the left navigation pane in Lighthouse, select **Users** > **Password reset**. -2. On the **Password reset** tab, select a tenant from the list to open the details pane. +2. On the **Password reset** page, select a tenant from the list to open the details pane. 3. Select the users that you want to notify. |
| lighthouse | M365 Lighthouse Reset User Password | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-reset-user-password.md | Microsoft 365 Lighthouse lets you change or reset user passwords. You can reset ## Reset a password for a user -1. In the left navigation pane in Lighthouse, select **Users** > **Search users**. +1. In the left navigation pane in Lighthouse, select **Users** > **Account management** > **Search users**. 2. On the **Search users** tab, enter a user's name in the search box. Microsoft 365 Lighthouse lets you change or reset user passwords. You can reset 1. In the left navigation pane in Lighthouse, select **Users** > **Risky users**. -2. On the **Risky Users** tab, select a risky user from the list. +2. On the **Risky Users** page, select a risky user from the list. 3. Select **Reset password**. |
| lighthouse | M365 Lighthouse Search For Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-search-for-users.md | description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthous Microsoft 365 Lighthouse lets you search for a specific user across all active tenants. This allows you to find a user quickly without needing to navigate different tenants. -1. In the left navigation pane in Lighthouse, select **Users** > **Search users**. +1. In the left navigation pane in Lighthouse, select **Users** > **Account management** > **Search users**. 2. In the search box, enter a display name or user principal name (UPN). |
| lighthouse | M365 Lighthouse Users Page Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-users-page-overview.md | description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthous Microsoft 365 Lighthouse lets you manage users across customer tenant accounts by selecting any of the links under **Users** in the left navigation pane. From the Users page, you can search for users and assess and act on the security state of your user accounts. You can also view insights into risky users and the status of multifactor authentication and self-service password reset. -## Search users tab +## Account management page -From the Search users tab, you can quickly search across tenants for specific users and perform common user management tasks like updating user account information, resetting passwords, assigning licenses, and managing a user's groups, mailbox, or OneDrive. +On the Account management page, you can quickly search across tenants for specific users and perform common user management tasks like updating user account information, resetting passwords, assigning licenses, and managing a user's groups, mailbox, or OneDrive. You can also view inactive accounts and take the appropriate security actions and reclaim unused licenses. -## Risky Users tab +## Risky Users page -The Risky Users tab shows user accounts across your tenants that have been flagged for risky behavior. Select any of the users to view more information on a detected risk or to mitigate a risk by resetting a user's password or blocking sign-in. For more information about risk types and detection, see [What is risk?](/azure/active-directory/identity-protection/concept-identity-protection-risks). +The Risky Users page shows user accounts across your tenants that have been flagged for risky behavior. Select any of the users to view more information on a detected risk or to mitigate a risk by resetting a user's password or blocking sign-in. For more information about risk types and detection, see [What is risk?](/azure/active-directory/identity-protection/concept-identity-protection-risks). -The Risky Users tab also includes the following options: +The Risky Users page also includes the following options: - **Export:** Select to export device compliance data to an Excel comma-separated values (.csv) file. - **Refresh:** Select to retrieve the most current device compliance data. - **Confirm user(s) compromised:** Select to confirm the user was compromised. The Risky Users tab also includes the following options: - **Reset password:** Select to change or reset user password. - **Block Sign-in:** Select to prevent anyone from signing in as this user. -## Multifactor Authentication tab +## Multifactor Authentication page -The Multifactor Authentication tab provides detailed information on the status of multifactor authentication (MFA) enablement across your tenants. Select any tenant in the list to see more details for that tenant, including which Conditional Access policies requiring MFA are already configured and which users haven't yet registered for MFA. +The Multifactor Authentication page provides detailed information on the status of multifactor authentication (MFA) enablement across your tenants. Select any tenant in the list to see more details for that tenant, including which Conditional Access policies requiring MFA are already configured and which users haven't yet registered for MFA. -## Password reset tab +## Password reset page -The Password reset tab shows detailed information on the status of self-service password reset enablement across your tenants. It also provides insights into users who are enabled but still need to register before they can reset their password on their own. +The Password reset page shows detailed information on the status of self-service password reset enablement across your tenants. It also provides insights into users who are enabled but still need to register before they can reset their password on their own. ## Related content |
| lighthouse | M365 Lighthouse View Manage Risky Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-view-manage-risky-users.md | In Azure AD Identity Protection, risk detections include any identified suspicio 1. In the left navigation pane in Lighthouse, select **Users** > **Risky users**. -2. On the **Risky Users** tab, review the users in the list with a risk state of **At risk**. +2. On the **Risky Users** page, review the users in the list with a risk state of **At risk**. 3. Select **View risk detections** to get detailed information about the risks detected for each user. For more information about risk types and detection, see [What is risk?](/azure/active-directory/identity-protection/concept-identity-protection-risks). To take action on multiple affected users at once: 1. In the left navigation pane in Lighthouse, select **Users** > **Risky users**. -2. On the **Risky Users** tab, select the set of users you want to take action on. +2. On the **Risky Users** page, select the set of users you want to take action on. 3. Choose one of the following actions to perform: |
| security | Compare Mdb M365 Plans | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/compare-mdb-m365-plans.md | Microsoft offers a wide variety of cloud solutions and services, including plans > [!NOTE] > This article provides a high-level overview of features and capabilities that are included in Microsoft Defender for Business (as a standalone plan) and Microsoft 365 Business Premium (which includes Defender for Business). It's not intended to be a service description or licensing contract document. For more detailed information, see [Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance). -| Microsoft Defender for Business (standalone) | Microsoft 365 Business Premium | +| Plan | Description | |:|:|-| Antivirus, antimalware, and ransomware protection capabilities for devices include: <ul><li>[Next-generation protection](../defender-endpoint/microsoft-defender-antivirus-in-windows-10.md) (antivirus/antimalware protection on devices together with cloud protection)</li><li>[Attack surface reduction](../defender-endpoint/overview-attack-surface-reduction.md) (network protection, firewall, and attack surface reduction rules) <sup>[[a](#fna)]</sup></li><li>[Endpoint detection and response](../defender-endpoint/overview-endpoint-detection-response.md) (behavior-based detection and manual response actions)</li><li>[Automated investigation and response](../defender/m365d-autoir.md) (with self-healing for detected threats)</li><li>[Microsoft Defender Vulnerability Management](mdb-view-tvm-dashboard.md) (view exposed devices and recommendations)</li><li>[Cross-platform support for devices](mdb-onboard-devices.md) (Windows, Mac, iOS, and Android) <sup>[[b](#fnb)]</sup></li><li>[Centralized management and reporting](mdb-get-started.md) (Microsoft 365 Defender portal)</li><li>[APIs for integration](../defender-endpoint/management-apis.md) (for Microsoft partners or your custom tools and apps)</li></ul><br/><br/><br/><br/><br/><br/><br/> | Productivity and security capabilities include:<ul><li>[Microsoft 365 Business Standard](../../admin/admin-overview/what-is-microsoft-365-for-business.md) (Office apps and services, and Microsoft Teams)</li><li>[Shared computer activation](/deployoffice/overview-shared-computer-activation) (for deploying Microsoft 365 Apps)</li><li>[Windows 10/11 Business](../../business-premium/m365bp-upgrade-windows-10-pro.md) (upgrade from previous versions of Windows Pro)</li><li>[Windows Autopilot](/mem/autopilot/windows-autopilot) (for setting up and configuring Windows devices)</li><li>[Exchange Online Protection](../office-365-security/exchange-online-protection-overview.md) (antiphishing, antispam, antimalware, and spoof intelligence for email)</li><li>[Defender for Business](mdb-overview.md) (everything listed in the "Defender for Business (standalone)" column) </li><li>[Microsoft Defender for Office 365 Plan 1](../office-365-security/overview.md) (advanced antiphishing, real-time detections, Safe Attachments, Safe Links)</li><li>[Auto-expanding archiving](../../compliance/autoexpanding-archiving.md) (for email)</li><li>[Azure Active Directory Premium Plan 1](/azure/active-directory/fundamentals/active-directory-whatis) (identity management)</li><li>[Microsoft Intune](/mem/intune/fundamentals/what-is-intune) (device onboarding and management)</li><li>[Azure Information Protection Premium Plan 1](/azure/information-protection/what-is-information-protection) (protection for sensitive information)</li><li>[Azure Virtual Desktop](/azure/virtual-desktop/overview) (centrally managed, secure virtual machines in the cloud)</li></ul> | +| **[Defender for Business](mdb-overview.md)** (standalone) | **Antivirus, antimalware, and ransomware protection for devices**<ul><li>[Next-generation protection](../defender-endpoint/microsoft-defender-antivirus-in-windows-10.md) (antivirus/antimalware protection on devices together with cloud protection)</li><li>[Attack surface reduction](../defender-endpoint/overview-attack-surface-reduction.md) (network protection, firewall, and attack surface reduction rules) <sup>[[a](#fna)]</sup></li><li>[Endpoint detection and response](../defender-endpoint/overview-endpoint-detection-response.md) (behavior-based detection and manual response actions)</li><li>[Automated investigation and response](../defender/m365d-autoir.md) (with self-healing for detected threats)</li><li>[Microsoft Defender Vulnerability Management](mdb-view-tvm-dashboard.md) (view exposed devices and recommendations)</li><li>[Cross-platform support for devices](mdb-onboard-devices.md) (Windows, Mac, iOS, and Android) <sup>[[b](#fnb)]</sup></li><li>[Centralized management and reporting](mdb-get-started.md) (Microsoft 365 Defender portal)</li><li>[APIs for integration](../defender-endpoint/management-apis.md) (for Microsoft partners or your custom tools and apps)</li></ul> | +| **[Microsoft 365 Business Premium](../../business-premium/index.md)** | **Defender for Business capabilities, together with productivity and additional security capabilities**<ul><li>[Microsoft 365 Business Standard](../../admin/admin-overview/what-is-microsoft-365-for-business.md) (Office apps and services, and Microsoft Teams)</li><li>[Shared computer activation](/deployoffice/overview-shared-computer-activation) (for deploying Microsoft 365 Apps)</li><li>[Windows 10/11 Business](../../business-premium/m365bp-upgrade-windows-10-pro.md) (upgrade from previous versions of Windows Pro)</li><li>[Windows Autopilot](/mem/autopilot/windows-autopilot) (for setting up and configuring Windows devices)</li><li>[Exchange Online Protection](../office-365-security/exchange-online-protection-overview.md) (antiphishing, antispam, antimalware, and spoof intelligence for email)</li><li>[Microsoft Defender for Office 365 Plan 1](../office-365-security/overview.md) (advanced antiphishing, real-time detections, Safe Attachments, Safe Links)</li><li>[Auto-expanding archiving](../../compliance/autoexpanding-archiving.md) (for email)</li><li>[Azure Active Directory Premium Plan 1](/azure/active-directory/fundamentals/active-directory-whatis) (identity management)</li><li>[Microsoft Intune](/mem/intune/fundamentals/what-is-intune) (device onboarding and management)</li><li>[Azure Information Protection Premium Plan 1](/azure/information-protection/what-is-information-protection) (protection for sensitive information)</li><li>[Azure Virtual Desktop](/azure/virtual-desktop/overview) (centrally managed, secure virtual machines in the cloud)</li></ul> | + (<a id="fna">a</a>) Microsoft Intune is required to modify or customize attack surface reduction rules. Intune is included in Microsoft 365 Business Premium. (<a id="fnb">b</a>) Microsoft Intune is required to onboard iOS and Android devices. See [Onboard devices to Microsoft Defender for Business](mdb-onboard-devices.md). Defender for Business brings the enterprise-grade capabilities of Defender for E |Feature/capability|[Defender for Business](mdb-overview.md)<br/>(standalone)|[Defender for Endpoint Plan 1](../defender-endpoint/defender-endpoint-plan-1.md)<br/>(for enterprise customers) |[Defender for Endpoint Plan 2](../defender-endpoint/microsoft-defender-endpoint.md)<br/>(for enterprise customers) | |||||-|[Centralized management](../defender-endpoint/manage-atp-post-migration.md) |Yes <sup>[[1](#fn1)]</sup>|Yes|Yes| -|[Simplified client configuration](mdb-simplified-configuration.md)|Yes|No|No| -|[Microsoft Defender Vulnerability Management](../defender-endpoint/next-gen-threat-and-vuln-mgt.md)|Yes|No|Yes| -|[Attack surface reduction capabilities](../defender-endpoint/overview-attack-surface-reduction.md)|Yes|Yes|Yes| -|[Next-generation protection](../defender-endpoint/next-generation-protection.md)|Yes|Yes|Yes| -|[Endpoint detection and response](../defender-endpoint/overview-endpoint-detection-response.md)|Yes <sup>[[2](#fn2)]</sup>|No|Yes| -|[Automated investigation and response](../defender-endpoint/automated-investigations.md)|Yes <sup>[[3](#fn3)]</sup>|No|Yes| -|[Threat hunting](../defender-endpoint/advanced-hunting-overview.md) and six months of data retention |No <sup>[[4](#fn4)]</sup>|No|Yes| -|[Threat analytics](../defender-endpoint/threat-analytics.md)|Yes <sup>[[5](#fn5)]</sup>|No|Yes| -|[Cross-platform support](../defender-endpoint/minimum-requirements.md) <br/>(Windows, Mac, iOS, and Android OS)|Yes <sup>[[6](#fn6)]</sup>|Yes|Yes| -|[Microsoft Threat Experts](../defender-endpoint/microsoft-threat-experts.md)|No|No|Yes| -|Partner APIs|Yes|Yes|Yes| -|[Microsoft 365 Lighthouse integration](../../lighthouse/m365-lighthouse-overview.md) <br/>(For viewing security incidents across customer tenants)|Yes |Yes <sup>[[7](#fn7)]</sup>|Yes <sup>[[7](#fn7)]</sup>| +|[Centralized management](../defender-endpoint/manage-atp-post-migration.md) <sup>[[1](#fn1)]</sup> | :::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included"::: |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::| +|[Simplified client configuration](mdb-simplified-configuration.md)|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::| | | +|[Microsoft Defender Vulnerability Management](../defender-endpoint/next-gen-threat-and-vuln-mgt.md)|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::| |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::| +|[Attack surface reduction capabilities](../defender-endpoint/overview-attack-surface-reduction.md)|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::| +|[Next-generation protection](../defender-endpoint/next-generation-protection.md)|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::| +|[Endpoint detection and response](../defender-endpoint/overview-endpoint-detection-response.md) <sup>[[2](#fn2)]</sup>|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included"::: | |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::| +|[Automated investigation and response](../defender-endpoint/automated-investigations.md) <sup>[[3](#fn3)]</sup>|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included"::: ||:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::| +|[Threat hunting](../defender-endpoint/advanced-hunting-overview.md) and six months of data retention <sup>[[4](#fn4)]</sup> | | |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::| +|[Threat analytics](../defender-endpoint/threat-analytics.md) <sup>[[5](#fn5)]</sup>|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included"::: | |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::| +|[Cross-platform support](../defender-endpoint/minimum-requirements.md) <br/>(Windows, Mac, iOS, and Android OS) <sup>[[6](#fn6)]</sup>|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included"::: |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::| +|[Microsoft Threat Experts](../defender-endpoint/microsoft-threat-experts.md)| | |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::| +|Partner APIs|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included":::| +|[Microsoft 365 Lighthouse integration](../../lighthouse/m365-lighthouse-overview.md) <br/>(For viewing security incidents across customer tenants) <sup>[[7](#fn7)]</sup>|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included"::: |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included"::: |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included"::: | (<a id="fn1">1</a>) Onboard and manage devices in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) or by using Microsoft Intune, managed in the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)). Defender for Business brings the enterprise-grade capabilities of Defender for E - Stop and quarantine a file - Add an indicator to block or allow a file -(<a id="fn3">3</a>) In Defender for Business, automated investigation and response is turned on by default, tenant wide. If you turn off automated investigation and response, that affects real-time protection. See [Review settings for advanced features](mdb-configure-security-settings.md#review-settings-for-advanced-features). +(<a id="fn3">3</a>) In Defender for Business, automated investigation and response is turned on by default, tenant wide. Turning off automated investigation and response affects real-time protection. See [Review settings for advanced features](mdb-configure-security-settings.md#review-settings-for-advanced-features). (<a id="fn4">4</a>) There's no timeline view in Defender for Business. |
| security | Mdb Configure Security Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-configure-security-settings.md | + - highpri # View and edit security policies and settings in Microsoft Defender for Business |
| security | Mdb Email Notifications | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-email-notifications.md | f1.keywords: NOCSH - M365-security-compliance - m365solution-mdb-setup+ - highpri # Set up email notifications |
| security | Mdb Onboard Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-onboard-devices.md | + - highpri # Onboard devices to Microsoft Defender for Business |
| security | Mdb Requirements | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-requirements.md | + - highpri # Microsoft Defender for Business requirements |
| security | Mdb Roles Permissions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-roles-permissions.md | + - highpri # Assign roles and permissions in Microsoft Defender for Business |
| security | Mdb Setup Configuration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-setup-configuration.md | + - highpri # Set up and configure Microsoft Defender for Business |
| security | TOC | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/TOC.md | ####### [Export non product code software inventory assessment](get-assessment-non-cpe-software-inventory.md) ####### [Export software vulnerabilities assessment](get-assessment-software-vulnerabilities.md) -###### [Automated Investigation]() +###### [Browser extensions]() +####### [Export broswer extenstions assessment](get-assessment-browser-extensions.md) +####### [Get browser extenstions permisson information](get-browser-extensions-permission-info.md) ++###### [Automated investigation]() ####### [Investigation methods and properties](investigation.md) ####### [List Investigation](get-investigation-collection.md) ####### [Get Investigation](get-investigation-object.md) |
| security | Attack Surface Reduction Rules Deployment Implement | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-implement.md | + - highpri Last updated 1/18/2022 |
| security | Attack Surface Reduction Rules Deployment Operationalize | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-operationalize.md | + - highpri Last updated 1/18/2022 |
| security | Attack Surface Reduction Rules Deployment Plan | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-plan.md | + - highpri Last updated 1/18/2022 |
| security | Attack Surface Reduction Rules Deployment Test | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-test.md | + - highpri Last updated 1/18/2022 |
| security | Attack Surface Reduction Rules Deployment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment.md | + - highpri Last updated 1/18/2022 |
| security | Client Behavioral Blocking | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/client-behavioral-blocking.md | |
| security | Cloud Protection Microsoft Antivirus Sample Submission | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-antivirus-sample-submission.md | Title: Cloud protection and sample submission at Microsoft Defender Antivirus description: Learn about cloud-delivered protection and Microsoft Defender Antivirus keywords: Microsoft Defender Antivirus, next-generation technologies, antivirus sample submission, next-generation av, machine learning, antimalware, security, defender, cloud, cloud-delivered protection+ ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium |
| security | Cloud Protection Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus.md | Title: Cloud protection and Microsoft Defender Antivirus description: Learn about cloud protection and Microsoft Defender Antivirus keywords: Microsoft Defender Antivirus, next-generation technologies, next-generation av, machine learning, antimalware, security, defender, cloud, cloud protection+ ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium |
| security | Collect Diagnostic Data Update Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/collect-diagnostic-data-update-compliance.md | Title: Collect diagnostic data for Update Compliance and Microsoft Defender Anti description: Use a tool to collect data to troubleshoot Update Compliance issues when using the Microsoft Defender Antivirus Assessment add-in. keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender AV, Microsoft Defender Antivirus search.product: eADQiWindows 10XVcnh+ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Collect Diagnostic Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/collect-diagnostic-data.md | Title: Collect diagnostic data of Microsoft Defender Antivirus description: Use a tool to collect data to troubleshoot Microsoft Defender Antivirus keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender av, group policy object, setting, diagnostic data, Microsoft Defender Antivirus search.product: eADQiWindows 10XVcnh+ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Collect Investigation Package | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/collect-investigation-package.md | Title: Collect investigation package API description: Use this API to create calls related to the collecting an investigation package from a device. keywords: apis, graph api, supported apis, collect investigation package+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Command Line Arguments Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/command-line-arguments-microsoft-defender-antivirus.md | Title: Use the command line to manage Microsoft Defender Antivirus description: Run Microsoft Defender Antivirus scans and configure next-generation protection with a dedicated command-line utility. keywords: run windows defender scan, run antivirus scan from command line, run windows defender scan from command line, mpcmdrun, defender+ ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium |
| security | Common Errors | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/common-errors.md | Title: Common Microsoft Defender for Endpoint API errors description: List of common Microsoft Defender for Endpoint API errors with descriptions. keywords: APIs, Microsoft Defender for Endpoint API, errors, troubleshooting+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Common Exclusion Mistakes Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/common-exclusion-mistakes-microsoft-defender-antivirus.md | Title: Common mistakes to avoid when defining exclusions description: Avoid common mistakes when defining exclusions for Microsoft Defender Antivirus scans. keywords: exclusions, files, extension, file type, folder name, file name, scans+ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Community | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/community.md | Title: Access the Microsoft Defender for Endpoint Community Center description: Access the Microsoft Defender for Endpoint Community Center to share experiences, engage, and learn about the product. keywords: community, community center, tech community, conversation, announcements+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro Last updated 04/24/2018+ |
| security | Conditional Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/conditional-access.md | description: Enable Conditional Access to prevent applications from running if a keywords: conditional access, block applications, security level, intune, search.product: eADQiWindows 10XVcnh search.appverid: met150+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configuration Management Reference Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configuration-management-reference-microsoft-defender-antivirus.md | Title: Manage Microsoft Defender Antivirus in your business description: Learn how to use Group Policy, Configuration Manager, PowerShell, WMI, Intune, and the command line to manage Microsoft Defender Antivirus keywords: group policy, gpo, config manager, sccm, scep, powershell, wmi, intune, defender, antivirus, antimalware, security, protection+ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Configure Advanced Scan Types Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-advanced-scan-types-microsoft-defender-antivirus.md | Title: Configure scanning options for Microsoft Defender Antivirus description: You can configure Microsoft Defender Antivirus to scan email storage files, back-up or reparse points, network files, and archived files (such as .zip files). keywords: advanced scans, scanning, email, archive, zip, rar, archive, reparse scanning ms.pagetype: security+ ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium |
| security | Configure Automated Investigations Remediation | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-automated-investigations-remediation.md | Title: Configure automated investigation and remediation capabilities description: Set up your automated investigation and remediation capabilities in Microsoft Defender for Endpoint. keywords: configure, setup, automated, investigation, detection, alerts, remediation, response++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Block At First Sight Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus.md | Title: Enable block at first sight to detect malware in seconds description: Turn on the block at first sight feature to detect and block malware within seconds. keywords: scan, block at first sight, malware, first sight, cloud, defender, antivirus+ ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high |
| security | Configure Cloud Block Timeout Period Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md | Title: Configure the Microsoft Defender Antivirus cloud block timeout period description: You can configure how long Microsoft Defender Antivirus will block a file from running while waiting for a cloud determination. keywords: Microsoft Defender Antivirus, antimalware, security, defender, cloud, timeout, block, period, seconds+ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Configure Conditional Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-conditional-access.md | Title: Configure Conditional Access in Microsoft Defender for Endpoint description: Learn about steps that you need to do in Intune, Microsoft 365 Defender, and Azure to implement Conditional access keywords: conditional access, conditional, access, device risk, risk level, integration, intune integration+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Contextual File Folder Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-contextual-file-folder-exclusions-microsoft-defender-antivirus.md | Title: Contextual file and folder exclusions description: Describes the contextual file and folder exclusions capability for Microsoft Defender Antivirus on Windows. This capability allows you to be more specific when you define under which context Microsoft Defender Antivirus shouldn't scan a file or folder, by applying restrictions keywords: Microsoft Defender Antivirus, process, exclusion, files, scans+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Device Discovery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-device-discovery.md | Title: Configure device discovery description: Learn how to configure device discovery in Microsoft 365 Defender using basic or standard discovery keywords: basic, standard, configure endpoint discovery, device discovery+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Email Notifications | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-email-notifications.md | Title: Configure alert notifications in Microsoft Defender for Endpoint description: You can use Microsoft Defender for Endpoint to configure email notification settings for security alerts, based on severity and other criteria. keywords: email notifications, configure alert notifications, Microsoft Defender for Endpoint, Microsoft Defender for Endpoint notifications, Microsoft Defender for Endpoint alerts, windows enterprise, windows education+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Endpoints Gp | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints-gp.md | Title: Onboard Windows devices to Microsoft Defender for Endpoint via Group Policy description: Use Group Policy to deploy the configuration package on Windows devices so that they are onboarded to the service. keywords: configure devices using group policy, device management, configure Microsoft Defender for Endpoint devices, onboard Microsoft Defender for Endpoint devices, group policy+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Endpoints Mdm | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints-mdm.md | Title: Onboard Windows devices to Defender for Endpoint using Intune description: Use Microsoft Intune to deploy the configuration package on devices so that they are onboarded to the Defender for Endpoint service. keywords: onboard devices using mdm, device management, onboard Microsoft Defender for Endpoint devices, mdm+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro + # Onboard Windows devices to Defender for Endpoint using Intune |
| security | Configure Endpoints Non Windows | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints-non-windows.md | description: Configure non-Windows devices so that they can send sensor data to keywords: onboard non-Windows devices, macos, linux, device management, configure Microsoft Defender for Endpoint devices search.product: eADQiWindows 10XVcnh search.appverid: met150+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Endpoints Sccm | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints-sccm.md | Title: Onboard Windows devices using Configuration Manager description: Use Configuration Manager to deploy the configuration package on devices so that they are onboarded to the Defender for Endpoint service. keywords: onboard devices using sccm, device management, configure Microsoft Defender for Endpoint devices+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Endpoints Script | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints-script.md | Title: Onboard Windows devices using a local script description: Use a local script to deploy the configuration package on devices to enable onboarding of the devices to the service. keywords: configure devices using a local script, device management, configure Microsoft Defender for Endpoint devices search.appverid: met150+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro + # Onboard Windows devices using a local script |
| security | Configure Endpoints Vdi | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints-vdi.md | description: Deploy the configuration package on virtual desktop infrastructure keywords: configure virtual desktop infrastructure (VDI) device, vdi, device management, configure Microsoft Defender for Endpoint, endpoints search.product: eADQiWindows 10XVcnh search.appverid: met150+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-exclusions-microsoft-defender-antivirus.md | Title: Set up exclusions for Microsoft Defender Antivirus scans description: You can exclude files (including files modified by specified processes) and folders from being scanned by Microsoft Defender Antivirus. Validate your exclusions with PowerShell. keywords:+ ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium |
| security | Configure Extension File Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus.md | Title: Configure and validate exclusions based on extension, name, or location description: Exclude files from Microsoft Defender Antivirus scans based on their file extension, file name, or location. keywords: exclusions, files, extension, file type, folder name, file name, scans++ ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium |
| security | Configure Local Policy Overrides Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-local-policy-overrides-microsoft-defender-antivirus.md | Title: Configure local overrides for Microsoft Defender Antivirus settings description: Enable or disable users from locally changing settings in Microsoft Defender Antivirus. keywords: local override, local policy, group policy, gpo, lockdown,merge, lists++ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Configure Machines Asr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-machines-asr.md | Title: Optimize ASR rule deployment and detections description: Optimize your attack surface reduction (ASR) rules to identify and prevent typical malware exploits. keywords: onboard, Intune management, Microsoft Defender for Endpoint, Microsoft Defender, Windows Defender, attack surface reduction, ASR, security baseline+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro + # Optimize ASR rule deployment and detections |
| security | Configure Machines Onboarding | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-machines-onboarding.md | Title: Get devices onboarded to Microsoft Defender for Endpoint description: Track onboarding of Intune-managed devices to Microsoft Defender for Endpoint and increase onboarding rate. keywords: onboard, Intune management, Microsoft Defender for Endpoint, Microsoft Defender, Windows Defender, configuration management+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Machines Security Baseline | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-machines-security-baseline.md | Title: Increase compliance to the Microsoft Defender for Endpoint security baseline description: The Microsoft Defender for Endpoint security baseline sets security controls to provide optimal protection. keywords: Intune management, Microsoft Defender for Endpoint, Microsoft Defender, Microsoft Defender for Endpoint ASR, security baseline+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Machines | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-machines.md | Title: Ensure your devices are configured properly description: Properly configure devices to boost overall resilience against threats and enhance your capability to detect and respond to attacks. keywords: onboard, Intune management, Microsoft Defender for Endpoint, Microsoft Defender, Windows Defender, attack surface reduction, ASR, security baseline+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro + # Ensure your devices are configured properly |
| security | Configure Microsoft Defender Antivirus Features | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-microsoft-defender-antivirus-features.md | Title: Configure Microsoft Defender Antivirus features description: You can configure Microsoft Defender Antivirus features with Intune, Microsoft Endpoint Configuration Manager, Group Policy, and PowerShell. keywords: Microsoft Defender Antivirus, antimalware, security, defender, configure, configuration, Config Manager, Microsoft Endpoint Configuration Manager, SCCM, Intune, MDM, mobile device management, GP, group policy, PowerShell++ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Configure Microsoft Threat Experts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-microsoft-threat-experts.md | |
| security | Configure Mssp Notifications | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-mssp-notifications.md | Title: Configure alert notifications that are sent to MSSPs description: Configure alert notifications that are sent to MSSPs keywords: managed security service provider, mssp, configure, integration+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Mssp Support | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-mssp-support.md | Title: Configure managed security service provider support description: Take the necessary steps to configure the MSSP integration with the Microsoft Defender for Endpoint keywords: managed security service provider, mssp, configure, integration+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Network Connections Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-network-connections-microsoft-defender-antivirus.md | Title: Configure and validate Microsoft Defender Antivirus network connections description: Configure and test your connection to the Microsoft Defender Antivirus cloud protection service. keywords: antivirus, Microsoft Defender Antivirus, antimalware, security, defender, cloud, aggressiveness, protection level++ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Configure Notifications Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-notifications-microsoft-defender-antivirus.md | Title: Configure Microsoft Defender Antivirus notifications description: Learn how to configure and customize both standard and other Microsoft Defender Antivirus notifications on endpoints. keywords: notifications, defender, antivirus, endpoint, management, admin++ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Configure Process Opened File Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md | Title: Configure exclusions for files opened by specific processes description: You can exclude files from scans if they have been opened by a specific process. keywords: Microsoft Defender Antivirus, process, exclusion, files, scans++ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Configure Protection Features Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-protection-features-microsoft-defender-antivirus.md | Title: Enable and configure Microsoft Defender Antivirus protection features description: Enable behavior-based, heuristic, and real-time protection in Microsoft Defender Antivirus. keywords: heuristic, machine learning, behavior monitor, real-time protection, always-on, Microsoft Defender Antivirus, antimalware, security, defender++ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Configure Proxy Internet | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-proxy-internet.md | description: Configure the Microsoft Defender for Endpoint proxy and internet se keywords: configure, proxy, internet, internet connectivity, settings, proxy settings, netsh, winhttp, proxy server search.product: eADQiWindows 10XVcnh search.appverid: met150+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Real Time Protection Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-real-time-protection-microsoft-defender-antivirus.md | Title: Enable and configure Microsoft Defender Antivirus protection capabilities description: Enable and configure Microsoft Defender Antivirus real-time protection features such as behavior monitoring, heuristics, and machine learning keywords: antivirus, real-time protection, rtp, machine learning, behavior monitoring, heuristics++ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Configure Remediation Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-remediation-microsoft-defender-antivirus.md | Title: Configure remediation for Microsoft Defender Antivirus detections description: Configure what Microsoft Defender Antivirus should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder keywords: remediation, fix, remove, threats, quarantine, scan, restore++ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Configure Server Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-server-endpoints.md | description: Onboard Windows servers so that they can send sensor data to the Mi keywords: onboard server, server, 2012r2, 2016, 2019, server onboarding, device management, configure Microsoft Defender for Endpoint servers, onboard Microsoft Defender for Endpoint servers, onboard Microsoft Defender for Endpoint servers search.product: eADQiWindows 10XVcnh search.appverid: met150+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Server Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-server-exclusions-microsoft-defender-antivirus.md | |
| security | Configure Siem | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-siem.md | Title: Integrate your SIEM tools with Microsoft Defender for Endpoint description: Learn how to ingest incidents and alerts, and integrate SIEM tools. keywords: configure siem, security information and events management tools, splunk, arcsight, custom indicators, rest api, alert definitions, indicators of compromise search.appverid: met150+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-updates.md | Title: Create a custom gradual rollout process for Microsoft Defender updates description: Learn how to use supported tools to create a custom gradual rollout process for updates keywords: update tools, gpo, intune, mdm, microsoft endpoint manager, policy, powershell++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Configure Vulnerability Email Notifications | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-vulnerability-email-notifications.md | Title: Configure vulnerability email notifications in Microsoft Defender for Endpoint description: Use Microsoft Defender for Endpoint to configure email notification settings for vulnerability events. keywords: email notifications, configure alert notifications, Microsoft Defender for Endpoint, Microsoft Defender for Endpoint notifications, Microsoft Defender for Endpoint alerts, windows enterprise, windows education+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Connected Applications | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/connected-applications.md | Title: Connected applications in Microsoft Defender for Endpoint description: View connected partner applications that use standard OAuth 2.0 protocol to authenticate and provide tokens for use with Microsoft Defender for Endpoint APIs. keywords: partners, applications, third-party, connections, sentinelone, lookout, bitdefender, corrata, morphisec, paloalto, ziften, better mobile+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Contact Support | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/contact-support.md | Title: Contact Microsoft Defender for Endpoint support description: Learn how to contact Microsoft Defender for Endpoint support keywords: support, contact, premier support, solutions, problems, case+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Controlled Folders | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/controlled-folders.md | Title: Protect important folders from ransomware from encrypting your files with controlled folder access description: Files in default folders can be protected from being changed by malicious apps. Prevent ransomware from encrypting your files. keywords: controlled folder access, windows 10, windows defender, ransomware, protect, files, folders+ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security audience: ITPro + Last updated |
| security | Corelight Integration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/corelight-integration.md | description: Enable Corelight integration to gain visibility focused on IoT/OT d keywords: enable siem connector, siem, connector, security information and events search.product: eADQiWindows 10XVcnh search.appverid: met150+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Create Alert By Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/create-alert-by-reference.md | Title: Create alert from event API description: Learn how to use the Create alert API to create a new Alert on top of Event in Microsoft Defender for Endpoint. keywords: apis, graph api, supported apis, get, alert, information, id+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Customize Controlled Folders | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/customize-controlled-folders.md | Title: Customize controlled folder access description: Add other folders that should be protected by controlled folder access, or allow apps that are incorrectly blocking changes to important files. keywords: Controlled folder access, windows 10, windows 11, windows defender, ransomware, protect, files, folders, customize, add folder, add app, allow, add executable+ ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium |
| security | Customize Exploit Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/customize-exploit-protection.md | Title: Customize exploit protection keywords: Exploit protection, mitigations, enable, powershell, dep, cfg, emet, aslr description: You can enable or disable specific mitigations used by exploit protection using the Windows Security app or PowerShell. You can also audit mitigations and export configurations.+ ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium |
| security | Customize Run Review Remediate Scans Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/customize-run-review-remediate-scans-microsoft-defender-antivirus.md | Title: Run and customize scheduled and on-demand scans. description: Customize and initiate Microsoft Defender Antivirus scans on endpoints across your network keywords: scan, schedule, customize, exclusions, exclude files, remediation, scan results, quarantine, remove threat, quick scan, full scan, Microsoft Defender Antivirus search.product: eADQiWindows 10XVcnh+ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Data Collection Analyzer | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/data-collection-analyzer.md | Title: Data collection for advanced troubleshooting on Windows description: Learn how to use the client analyzer to collect data for complex troubleshooting scenarios keywords: analzyer, collect data, troubleshooting mdeclientanalyzer, advanced troubleshooting+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Data Retention Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/data-retention-settings.md | Title: Verify data storage location and update data retention settings description: Verify data storage location and update data retention settings for Microsoft Defender for Endpoint keywords: data, storage, settings, retention, update+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Data Storage Privacy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/data-storage-privacy.md | Title: Microsoft Defender for Endpoint data storage and privacy description: Learn about how Microsoft Defender for Endpoint handles privacy and data that it collects. keywords: Microsoft Defender for Endpoint, data storage and privacy, storage, privacy, licensing, geolocation, data retention, data+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Defender Compatibility | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-compatibility.md | description: Learn about how Windows Defender works with Microsoft Defender for keywords: windows defender compatibility, defender, Microsoft Defender for Endpoint, defender for endpoint, antivirus, mde search.product: eADQiWindows 10XVcnh search.appverid: met150+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro Last updated 05/06/2021+ # Antivirus solution compatibility with Microsoft Defender for Endpoint |
| security | Defender Endpoint False Positives Negatives | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-false-positives-negatives.md | Title: Address false positives/negatives in Microsoft Defender for Endpoint description: Learn how to handle false positives or false negatives in Microsoft Defender for Endpoint. keywords: antivirus, exception, exclusion, Microsoft Defender for Endpoint, false positive, false negative, blocked file, blocked url++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security +- highpri Last updated 12/02/2021 |
| security | Defender Endpoint Plan 1 2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2.md | |
| security | Defender Endpoint Plan 1 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1.md | |
| security | Defender Endpoint Trial Playbook | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-trial-playbook.md | |
| security | Delete Library | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/delete-library.md | description: Learn how to delete a file from the live response library. keywords: apis, graph api, supported apis, delete from library search.product: eADQiWindows 10XVcnh search.appverid: met150+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro - M365-security-compliance + |
| security | Delete Ti Indicator By Id | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/delete-ti-indicator-by-id.md | Title: Delete Indicator API. description: Learn how to use the Delete Indicator API to delete an Indicator entity by ID in Microsoft Defender for Endpoint. keywords: apis, public api, supported apis, delete, ti indicator, entity, id+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Deploy Manage Report Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deploy-manage-report-microsoft-defender-antivirus.md | Title: Deploy, manage, and report on Microsoft Defender Antivirus description: You can deploy and manage Microsoft Defender Antivirus with Intune, Microsoft Endpoint Configuration Manager, Group Policy, PowerShell, or WMI keywords: deploy, manage, update, protection, Microsoft Defender Antivirus+ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Deploy Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deploy-microsoft-defender-antivirus.md | Title: Deploy and enable Microsoft Defender Antivirus description: Deploy Microsoft Defender Antivirus for protection of your endpoints with Microsoft Intune, Microsoft Endpoint Configuration Manager, Group Policy, PowerShell cmdlets, or WMI. keywords: deploy, enable, Microsoft Defender Antivirus+ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security |
| security | Deployment Phases | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deployment-phases.md | Title: Microsoft Defender for Endpoint deployment overview description: Learn how to deploy Microsoft Defender for Endpoint by preparing, setting up, and onboarding endpoints to that service keywords: deploy, prepare, setup, onboard, phase, deployment, deploying, adoption, configuring+ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security + - highpri + # Microsoft Defender for Endpoint deployment overview |
| security | Deployment Rings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deployment-rings.md | audience: ITPro - M365-security-compliance - m365solution-endpointprotect+ - highpri ms.technology: mde |
| security | Evaluation Lab | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/evaluation-lab.md | audience: ITPro - M365-security-compliance - m365solution-evalutatemtp+ - highpri ms.technology: mde |
| security | Export Certificate Inventory Assessment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/export-certificate-inventory-assessment.md | Data that is collected using either '_JSON response_ or _via files_' is the curr Returns all certificate assessments for all devices, on a per-device basis. It returns a table with a separate entry for every unique combination of DeviceId, Thumbprint and Path. -#### 1.2 Limitations +#### 1.1.1 Limitations - Maximum page size is 200,000. - Rate limitations for this API are 30 calls per minute and 1000 calls per hour. -### 1.3 Parameters +### 1.2 Permissions -- pageSize (default = 50,000): Number of results in response.-- $top: Number of results to return (doesn't return @odata.nextLink and so doesn't pull all the data).+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs for details.](apis-intro.md) ++Permission type|Permission|Permission display name +:|:|: +Application|Software.Read.All|'Read Threat and Vulnerability Management software information' +Delegated (work or school account)|Software.Read|'Read Threat and Vulnerability Management software information' -### 1.4 HTTP request +### 1.3 URL ```http GET /api/machines/certificateAssessmentByMachine ``` +### 1.4 Parameters ++- pageSize (default = 50,000): Number of results in response. +- $top: Number of results to return (doesn't return @odata.nextLink and so doesn't pull all the data). ++ ### 1.5 Properties (JSON response) > [!NOTE] GET https://api.securitycenter.microsoft.com/api/machines/BaselineComplianceAsse Returns all certificate assessments for all devices, on a per-device basis. It returns a table with a separate entry for every unique combination of DeviceId, Thumbprint and Path. -#### 2.2 Limitations +#### 2.1.1 Limitations -- Rate limitations for this API are 5 calls per minute and 20 calls per hour. +- Rate limitations for this API are 5 calls per minute and 20 calls per hour. -### 2.3 Parameters +### 2.2 Permissions -- sasValidHours: The number of hours that the download URLs will be valid for (Maximum 24 hours).+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs for details.](apis-intro.md) ++Permission type|Permission|Permission display name +:|:|: +Application|Software.Read.All|'Read Threat and Vulnerability Management software information' +Delegated (work or school account)|Software.Read|'Read Threat and Vulnerability Management software information' -### 2.4 HTTP request +### 2.3 URL ```http GET /api/machines/certificateAssessmentExport ``` +### 2.4 Parameters ++- sasValidHours: The number of hours that the download URLs will be valid for (Maximum 24 hours). + ### 2.5 Properties (JSON response) > [!NOTE] |
| security | Get Assessment Browser Extensions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-assessment-browser-extensions.md | + + Title: Export browser extensions assessment +description: Returns a table with an entry for every unique combination of DeviceId, BrowserName, ExtensionID. +keywords: api, apis, export assessment, per device assessment, vulnerability assessment report, device vulnerability assessment, device vulnerability report, browser extension assessment +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro +++ms.technology: mde ++++# Export browser extensions assessment per device +++**Applies to:** ++- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037) +- [Microsoft Defender Vulnerability Management](../defender-vulnerability-management/index.yml) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ++> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink). ++> Want to experience Microsoft Defender Vulnerability Management? Learn more about how you can sign up to the [Microsoft Defender Vulnerability Management public preview trial](../defender-vulnerability-management/get-defender-vulnerability-management.md). ++Returns all known installed browser extensions and their details for all devices, on a per-device basis. ++Different API calls get different types of data. Because the amount of data can be large, there are two ways it can be retrieved: ++- [Export browser extensions assessment **JSON response**](#1-export-browser-extensions-assessment-json-response) The API pulls all data in your organization as Json responses. This method is best for _small organizations with less than 100-K devices_. The response is paginated, so you can use the \@odata.nextLink field from the response to fetch the next results. ++- [Export browser extensions assessment **via files**](#2-export-browser-extension-assessment-via-files) This API solution enables pulling larger amounts of data faster and more reliably. So, it's recommended for large organizations, with more than 100-K devices. This API pulls all data in your organization as download files. The response contains URLs to download all the data from Azure Storage. This API enables you to download all your data from Azure Storage as follows: + - Call the API to get a list of download URLs with all your organization data. + - Download all the files using the download URLs and process the data as you like. ++Data that is collected (using either _Json response_ or _via files_) is the current snapshot of the current state. It doesn't contain historic data. To collect historic data, customers must save the data in their own data storages. ++> [!NOTE] +> Unless indicated otherwise, all export assessment methods listed are **_full export_** and **_by device_** (also referred to as **_per device_**). ++## 1. Export browser extensions assessment (JSON response) ++### 1.1 API method description ++This API response contains all the data for installed browser extensions per device. Returns a table with an entry for every unique combination of DeviceId, BrowserName, ExtensionId. ++#### 1.1.1 Limitations ++- Maximum page size is 200,000. +- Rate limitations for this API are 30 calls per minute and 1000 calls per hour. ++### 1.2 Permissions ++One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs for details.](apis-intro.md) ++Permission type|Permission|Permission display name +:|:|: +Application|Software.Read.All|'Read Threat and Vulnerability Management software information' +Delegated (work or school account)|Software.Read|'Read Threat and Vulnerability Management software information' ++### 1.3 URL ++```http +GET api/Machines/BrowserExtensionsInventoryByMachine +``` ++### 1.4 Parameters ++- pageSize (default = 50,000): Number of results in response. +- $top: Number of results to return (doesn't return @odata.nextLink and therefore doesn't pull all the data) ++### 1.5 Properties ++> [!NOTE] +> +> - Each record is approximately 0.5KB of data. You should take this into account when choosing the correct pageSize parameter for you. +> - The properties defined in the following table are listed alphabetically, by property ID. When running this API, the resulting output will not necessarily be returned in the same order listed in this table. +> - Some additional columns might be returned in the response. These columns are temporary and might be removed, please use only the documented columns. ++<br> ++**** ++Property (ID)|Data type|Description +:|:|: +BrowserName|string|Name of the browser where the extension is installed. +DeviceId|string|Unique identifier for the device. +DeviceName|string|Fully qualified domain name (FQDN) of the device. +ExtensionDescription|string| Description of a specific browser extension. +ExtensionId|string|Unique identifier for a specific browser extension. +ExtensionName|string|Name of a specific browser extension. +ExtensionRisk|string|The highest risk level generated by the browser extension. Possible values are: "None", "Low", "Medium", "High", "Critical". +ExtensionVersion|string|Version number of a specific browser extension. +IsActivated|Boolean|Indicates whether a browser extension is active. +RbacGroupId|integer|The role-based access control (RBAC) group ID. +RbacGroupName|string|The role-based access control (RBAC) group. If this device is not assigned to any RBAC group, the value will be "Unassigned." If the organization doesn't contain any RBAC groups, the value will be "None." +InstallationTime|string|The time the browser extension was installed. +Permissions|Array[string]|The set of permissions requested by a specific browser extension. ++### 1.6 Examples ++#### 1.6.1 Request example ++```http +GET https://api.securitycenter.microsoft.com/api/Machines/BrowserExtensionsInventoryByMachine?pageSize=5 &sinceTime=2021-05-19T18%3A35%3A49.924Z +``` ++#### 1.6.2 Response example ++```json +{ + "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Collection(contoso.windowsDefenderATP.api.AssetSoftware)", + "value": [ + { + "DeviceId": "1c32162b42e9efa1f5de42f951775f22f435c997", + "DeviceName": "computerpii_1363c2e016e2225cb03974df58f14e6968067aa8.domainpii_f260e982985f7e8eee198b4332e0ae5b2a069cd6.corp.microsoft.com", + "RbacGroupId": 86, + "RbacGroupName": "UnassignedGroup", + "InstallationTime": "2022-05-26T18:46:27.000Z", + "BrowserName": "chrome", + "ExtensionId": "dkpejdfnpdkhifgbancbammdijojoffk", + "ExtensionName": "Logitech Smooth Scrolling", + "ExtensionDescription": "Buttery-smooth scrolling for Logitech mice and touchpads.", + "ExtensionVersion": "6.65.62", + "ExtensionRisk": "High", + "IsActivated": true, + "Permissions": [ + { + "Id": "tabs", + "IsRequired": true, + "Risk": "High" + }, + { + "Id": http://*/*, + "IsRequired": true, + "Risk": "High" + }, + { + "Id": https://*/*, + "IsRequired": true, + "Risk": "High" + } + ] +} + ], + "@odata.nextLink": "https://api.securitycenter.microsoft.com/api/Machines/BrowserExtensionsInventoryByMachine?pagesize=5&$skiptoken=eyJFeHBvcnREZWZpbml0aW9uIjp7IlRpbWVQYXRoIjoiMjAyMS0wMS0yNS8wMjAwLyJ9LCJFeHBvcnRGaWxlSW5kZXgiOjAsIkxpbmVTdG9wcGVkQXQiOjV9" +} +``` ++## 2. Export browser extension assessment (via files) ++### 2.1 API method description ++This API response contains all the data for installed browser extensions per device. Returns a table with an entry for every unique combination of DeviceId, BrowserName, ExtensionId. ++#### 2.1.1 Limitations ++Rate limitations for this API are 5 calls per minute and 20 calls per hour. ++### 2.2 Permissions ++One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs for details.](apis-intro.md) ++Permission type|Permission|Permission display name +:|:|: +Application|Software.Read.All|'Read Threat and Vulnerability Management software information' +Delegated (work or school account)|Software.Read|'Read Threat and Vulnerability Management software information' ++### 2.3 URL ++```http +GET /api/Machines/BrowserExtensionsInventoryByMachine +``` ++### 2.4 Parameters ++- sasValidHours: The number of hours that the download URLs will be valid for (Maximum 24 hours) ++### 2.5 Properties ++> [!NOTE] +> +> - The files are gzip compressed & in multiline JSON format. +> - The download URLs are only valid for 3 hours. Otherwise you can use the parameter. +> - For maximum download speed of your data, you can make sure you are downloading from the same Azure region that your data resides. ++<br> ++**** ++Property (ID)|Data type|Description|Example of a returned value +:|:|:|: +Export files|array\[string\]|A list of download URLs for files holding the current snapshot of the organization|"[Https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...1", "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...2"] +GeneratedTime|string|The time that the export was generated.|2021-05-20T08:00:00Z ++### 2.6 Examples ++#### 2.6.1 Request example ++```http +GET https://api.securitycenter.microsoft.com/api/machines/BrowserExtensionsExport +``` ++#### 2.6.2 Response example ++```json +{ + "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#microsoft.windowsDefenderATP.api.ExportFilesResponse", + "exportFiles": [ + "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export/2021-01-11/1101/BrowserExtensions/json/OrgId=12345678-195f-4223-9c7a-99fb420fd000/part-00393-e423630d-4c69-4490-8769-a4f5468c4f25.c000.json.gz?sv=2019-12-12&st=2021-01-11T11%3A55%3A51Z&se=2021-01-11T14%3A55%3A51Z&sr=b&sp=r&sig=...", + "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export/2021-01-11/1101/BrowserExtensions/json/OrgId=12345678-195f-4223-9c7a-99fb420fd000/part-00394-e423630d-4c69-4490-8769-a4f5468c4f25.c000.json.gz?sv=2019-12-12&st=2021-01-11T11%3A55%3A51Z&se=2021-01-11T14%3A55%3A51Z&sr=b&sp=r&sig=...", + "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export/2021-01-11/1101/BrowserExtensions/json/OrgId=12345678-195f-4223-9c7a-99fb420fd000/part-00394-e423630d-4c69-4490-8769-a4f5468c4f25.c001.json.gz?sv=2019-12-12&st=2021-01-11T11%3A55%3A51Z&se=2021-01-11T14%3A55%3A51Z&sr=b&sp=r&sig=..." + ], + "generatedTime": "2021-01-11T11:01:00Z" +} +``` ++## See also ++- [Get browser extensions permission info](get-browser-extensions-permission-info.md) +- [Browser extensions assessment](../defender-vulnerability-management/tvm-browser-extensions.md) ++## Other related ++- [Vulnerability management](../defender-vulnerability-management/defender-vulnerability-management.md) +- [Vulnerabilities in your organization](../defender-vulnerability-management/tvm-weaknesses.md) |
| security | Get Assessment Non Cpe Software Inventory | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-assessment-non-cpe-software-inventory.md | One of the following permissions is required to call this API. To learn more, in Permission type|Permission|Permission display name ||-Application|Software.Read.All|\'Read Threat and Vulnerability Management vulnerability information\' -Delegated (work or school account)|Software.Read|\'Read Threat and Vulnerability Management vulnerability information\' +Application|Software.Read.All|\'Read Threat and Vulnerability Management software information\' +Delegated (work or school account)|Software.Read|\'Read Threat and Vulnerability Management software information\' ### 1.3 URL One of the following permissions is required to call this API. To learn more, in Permission type|Permission|Permission display name ||-Application|Software.Read.All|\'Read Threat and Vulnerability Management vulnerability information\' -Delegated (work or school account)|Software.Read|\'Read Threat and Vulnerability Management vulnerability information\' +Application|Software.Read.All|\'Read Threat and Vulnerability Management software information\' +Delegated (work or school account)|Software.Read|\'Read Threat and Vulnerability Management software information\' ### 2.3 URL |
| security | Get Assessment Secure Config | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-assessment-secure-config.md | GET https://api.securitycenter.microsoft.com/api/machines/SecureConfigurationsAs This API response contains the Secure Configuration Assessment on your exposed devices, and returns an entry for every unique combination of DeviceId, ConfigurationId. -#### 2.1.2 Limitations +#### 2.1.1 Limitations Rate limitations for this API are 5 calls per minute and 20 calls per hour. One of the following permissions is required to call this API. To learn more, in Permission type|Permission|Permission display name ||-Application|Vulnerability.Read.All|\'Read "threat and vulnerability management" vulnerability information\' -Delegated (work or school account)|Vulnerability.Read|\'Read "threat and vulnerability management" vulnerability information\' +Application|Vulnerability.Read.All|\'Read Threat and Vulnerability Management vulnerability information\' +Delegated (work or school account)|Vulnerability.Read|\'Read Threat and Vulnerability Management vulnerability information\' ### 2.3 URL |
| security | Get Assessment Software Inventory | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-assessment-software-inventory.md | Data that is collected (using either _Json response_ or _via files_) is the curr This API response contains all the data of installed software that has a [Common Platform Enumeration(CPE)](https://nvd.nist.gov/products/cpe), per device. Returns a table with an entry for every unique combination of DeviceId, SoftwareVendor, SoftwareName, SoftwareVersion. -#### Limitations +#### 1.1.1 Limitations - Maximum page size is 200,000. - Rate limitations for this API are 30 calls per minute and 1000 calls per hour. One of the following permissions is required to call this API. To learn more, in Permission type|Permission|Permission display name ||-Application|Software.Read.All|\'Read Threat and Vulnerability Management vulnerability information\' -Delegated (work or school account)|Software.Read|\'Read Threat and Vulnerability Management vulnerability information\' +Application|Software.Read.All|\'Read Threat and Vulnerability Management software information\' +Delegated (work or school account)|Software.Read|\'Read Threat and Vulnerability Management software information\' ### 1.3 URL One of the following permissions is required to call this API. To learn more, in Permission type|Permission|Permission display name ||-Application|Software.Read.All|\'Read Threat and Vulnerability Management vulnerability information\' -Delegated (work or school account)|Software.Read|\'Read Threat and Vulnerability Management vulnerability information\' +Application|Software.Read.All|\'Read Threat and Vulnerability Management software information\' +Delegated (work or school account)|Software.Read|\'Read Threat and Vulnerability Management software information\' ### 2.3 URL |
| security | Get Browser Extensions Permission Info | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-browser-extensions-permission-info.md | + + Title: Get browser extensions permission info +description: Retrieves a list of all permissions required for a browser extension +keywords: apis, graph api, supported apis, get, browser extension information, Microsoft Defender for Endpoint, Microsoft Defender Vulnerability Management +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro +++MS.technology: mde ++++# Get browser extensions permission information +++**Applies to:** ++- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037) +- [Microsoft Defender Vulnerability Management](../defender-vulnerability-management/index.yml) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ++> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink). ++> Want to experience Microsoft Defender Vulnerability Management? Learn more about how you can sign up to the [Microsoft Defender Vulnerability Management public preview trial](../defender-vulnerability-management/get-defender-vulnerability-management.md). +++++## API description ++Retrieves a list of all the permissions requested by a specific browser extension. This is a static data description and would mainly be used to enhance the data returned by the [Export browser extensions assessment API](get-assessment-browser-extensions.md). ++By combining these APIs youΓÇÖll be able to see a description of the permissions requested by the browser extensions that come up in the [Export browser extensions assessment](get-assessment-browser-extensions.md) results. ++<br>Supports [OData V4 queries](https://www.odata.org/documentation/). +<br>OData supported operators: +<br>```$filter``` on: ```id```, ```name```, ```description```, ```cvssV3```, ```publishedOn```, ```severity```, and ```updatedOn``` properties. +<br>```$top``` with max value of 10,000. +<br>```$skip```. +<br>See examples at [OData queries with Microsoft Defender for Endpoint](exposed-apis-odata-samples.md). ++## Permissions ++One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md) for details. ++Permission type|Permission|Permission display name +:|:|: +Application|Software.Read.All|'Read Threat and Vulnerability Management software information' +Delegated (work or school account)|Software.Read|'Read Threat and Vulnerability Management software information' ++## HTTP request ++```http +GET api/browserextensions/permissionsinfo +``` ++## Request headers ++Name|Type|Description +:|:|: +Authorization|String|Bearer {token}. **Required**. ++## Request body ++Empty ++## Response ++If successful, this method returns 200 OK with the list of all permissions requested by a browser extension in the body. ++## Example ++### Request example ++Here is an example of the request. ++```http +GET https://api.securitycenter.microsoft.com/api/browserextensions/permissionsinfo +``` ++### Response example ++Here is an example of the response. ++```json +{ + "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#BrowserExtension", + "value": [ +{ + "value": [ + { + "key": "audioCapture", + "permissionName": "Capture audio from attached mic or webcam", + "description": "Capture audio from attached mic or webcam. Could be used to listen in on use." + }, + { + "key": "app.window.fullscreen.overrideEsc", + "permissionName": "Prevent escape button from exiting fullscreen", + "description": "Can prevent escape button from exiting fullscreen." + }, + { + "key": "browsingData", + "permissionName": "Clear browsing data", + "description": "Clears browsing data which could result in a forensics/logging issues." + }, + { + "key": "content_security_policy", + "permissionName": "Can manipulate default Content Security Policy (CSP)", + "description": "CSP works as a block/allow listing mechanism for resources loaded or executed by your extensions. Can manipulate default CSP." + } ++ ] +} + ] +``` ++## See also ++- [Get browser extensions permission info](get-assessment-browser-extensions.md) +- [Browser extensions assessment](../defender-vulnerability-management/tvm-browser-extensions.md) ++## Other related ++- [Vulnerability management](../defender-vulnerability-management/defender-vulnerability-management.md) +- [Vulnerabilities in your organization](../defender-vulnerability-management/tvm-weaknesses.md) |
| security | Microsoft Defender Antivirus Compatibility | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility.md | ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium Last updated : 08/30/2022 In order for Microsoft Defender Antivirus to run in passive mode, endpoints must > [!IMPORTANT] > - Microsoft Defender Antivirus is only available on devices running Windows 10 and 11, Windows Server 2022, Windows Server 2019, Windows Server, version 1803 or newer, Windows Server 2016, and Windows Server 2012 R2.+> - Passive mode is only supported on Windows Server 2012 R2 & 2016 when the device is onboarded using the [modern, unified solution](/microsoft-365/security/defender-endpoint/configure-server-endpoints). > - In Windows 8.1, enterprise-level endpoint antivirus protection is offered as [System Center Endpoint Protection](/previous-versions/system-center/system-center-2012-R2/hh508760(v=technet.10)), which is managed through Microsoft Endpoint Configuration Manager. > - Windows Defender is also offered for [consumer devices on Windows 8.1](/previous-versions/windows/it-pro/windows-8.1-and-8/dn344918(v=ws.11)#BKMK_WindowsDefender), although Windows Defender does not provide enterprise-level management. |
| security | Microsoft Defender Offline | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-offline.md | ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium Previously updated : 07/28/2022 Last updated : 08/30/2022 See the following for more information: > - [Configure Defender for Endpoint on Android features](android-configure.md) > - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) +### Where can I find the scan results? ++To see the Microsoft Defender Offline scan results: ++1. Select **Start**, and then select **Settings** > **Update & Security** > **Windows Security** > **Virus & threat protection**. ++2. On the **Virus & threat protection** screen, under **Current threats**, select **Scan options**, and then select **Protection history**. + ## Related articles - [Customize, initiate, and review the results of scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) |
| security | Onboarding Endpoint Manager | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/onboarding-endpoint-manager.md | + - highpri ms.technology: mde |
| security | Onboarding | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/onboarding.md | + - highpri ms.technology: mde |
| security | Prepare Deployment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/prepare-deployment.md | + - highpri ms.technology: mde |
| security | Production Deployment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/production-deployment.md | + - highpri ms.technology: mde |
| security | Switch To Mde Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/switch-to-mde-overview.md | +- highpri Last updated 11/29/2021 |
| security | Switch To Mde Phase 1 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/switch-to-mde-phase-1.md | audience: ITPro - M365-security-compliance - m365solution-migratetomdatp- - m365solution-mcafeemigrate - - m365solution-symantecmigrate + - highpri - migrationguides |
| security | Switch To Mde Phase 2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/switch-to-mde-phase-2.md | + - highpri |
| security | Switch To Mde Phase 3 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/switch-to-mde-phase-3.md | audience: ITPro - M365-security-compliance - m365solution-migratetomdatp- - m365solution-mcafeemigrate - - m365solution-symantecmigrate + - highpri - migrationguides - admindeeplinkDEFENDER |
| security | Defender Vulnerability Management Capabilities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-capabilities.md | |
| security | Defender Vulnerability Management Faq | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-faq.md | Title: Microsoft Defender Vulnerability Management frequently asked questions description: Find answers to frequently asked questions (FAQs) about MDVM keywords: defender vulnerability management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Defender Vulnerability Management Trial | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-trial.md | Title: About the Microsoft Defender Vulnerability Management public preview trial description: Learn about the Microsoft Defender Vulnerability Management trial keywords: defender vulnerability management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Defender Vulnerability Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management.md | Title: Microsoft Defender Vulnerability Management description: This capability in Microsoft Defender Vulnerability Management uses a game-changing risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations. keywords: vulnerability management, threat and vulnerability management, Microsoft Defender for Endpoint TVM, Microsoft Defender for Endpoint-TVM, vulnerability management, vulnerability assessment, threat and vulnerability scanning, secure configuration assessment, Microsoft Defender for Endpoint, Microsoft Defender Vulnerability Management, endpoint vulnerabilities, next generation++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Get Defender Vulnerability Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/get-defender-vulnerability-management.md | |
| security | Threat And Vuln Mgt Event Timeline | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/threat-and-vuln-mgt-event-timeline.md | Title: Event timeline description: Event timeline is a risk news feed that helps you interpret how risk is introduced into the organization, and which mitigations happened to reduce it. keywords: event timeline, Microsoft Defender for Endpoint event timeline, Microsoft Defender for Endpoint tvm event timeline, threat and vulnerability management, Microsoft Defender for Endpoint, mdvm, Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Trial Playbook Defender Vulnerability Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/trial-playbook-defender-vulnerability-management.md | Title: Trial playbook - Microsoft Defender Vulnerability Management (public preview) description: Learn how Microsoft Defender Vulnerability Management can help you protect all your users and data. keywords: vulnerability management, threat and vulnerability management, Microsoft Defender for Endpoint TVM, Microsoft Defender for Endpoint-TVM, vulnerability management, vulnerability assessment, threat and vulnerability scanning, secure configuration assessment, Microsoft Defender for Endpoint, Microsoft Defender Vulnerability Management, endpoint vulnerabilities, next generation++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Assign Device Value | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-assign-device-value.md | Title: Assign device value description: Learn how to assign a low, normal, or high value to a device to help you differentiate between asset priorities. keywords: Microsoft Defender for Endpoint device value, threat and vulnerability management device value, high value devices, device value exposure score, Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Block Vuln Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-block-vuln-apps.md | Title: Block vulnerable applications (beta) description: Use Microsoft Defender Vulnerability Management to block vulnerable applications keywords: Microsoft Defender Vulnerability Management, Microsoft Defender for Endpoint block vulnerable applications, mdvm, vulnerability management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro - m365-security-compliance # Block vulnerable applications (beta) |
| security | Tvm Browser Extensions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-browser-extensions.md | Title: Browser extensions assessment description: Find out about the browsers extensions installed in your environment keywords: Microsoft Defender for Endpoint browser extensions, mdvm, threat & vulnerability management,Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security You can also view a list of extensions installed on a device: :::image type="content" source="../../media/defender-vulnerability-management/browser_extensions_devicepage.png" alt-text="Screenshot of the Browser extensions in the devices page" lightbox="../../media/defender-vulnerability-management/browser_extensions_devicepage.png"::: +### Browser extension APIs ++You can use APIs to view all browser extensions installed in your organization, including installed versions, permissions requested, and associated risk. For more information, see: ++- [Export browser extensions assessment per device](../defender-endpoint/get-assessment-browser-extensions.md) +- [Get browser extensions permission information](../defender-endpoint/get-browser-extensions-permission-info.md) + ### Use advanced hunting You can use advanced hunting queries to gain visibility on browser extensions in your organization. Find details about the browser extensions installed per device in the **DeviceTVMBrowserExtensions** table, or browser extension related information, including extensions permission information in the **DeviceTVMBrowserExtensionsKB** table. |
| security | Tvm Certificate Inventory | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-certificate-inventory.md | Title: Certificate inventory description: Find out about the certificates installed in your environment keywords: Microsoft Defender for Endpoint browser extensions, mdvm, vulnerability management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Dashboard Insights | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-dashboard-insights.md | Title: Dashboard insights description: The Microsoft Defender Vulnerability Management dashboard can help SecOps and security admins address cybersecurity threats and build their organization's security resilience. keywords: Microsoft Defender for Endpoint-tvm, Microsoft Defender for Endpoint-tvm dashboard, threat & vulnerability management, threat and vulnerability management, risk-based threat & vulnerability management, security configuration, Microsoft Secure Score for Devices, exposure score, Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm End Of Support Software | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-end-of-support-software.md | Title: Plan for end-of-support software and software versions description: Discover and plan for software and software versions that are no longer supported and won't receive security updates. keywords: threat and vulnerability management, Microsoft Defender for Endpoint tvm security recommendation, cybersecurity recommendation, actionable security recommendation, Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Exception | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-exception.md | Title: Create and view exceptions for security recommendations description: Create and monitor exceptions for security recommendations in Microsoft Defender Vulnerability Management. keywords: Microsoft Defender for Endpoint tvm remediation, Microsoft Defender for Endpoint tvm, threat and vulnerability management, threat & vulnerability management, threat & vulnerability management remediation, tvm remediation intune, tvm remediation sccm, mdvm, Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Exposure Score | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-exposure-score.md | Title: Exposure score in Defender Vulnerability Management description: The Microsoft Defender Vulnerability Management exposure score reflects how vulnerable your organization is to cybersecurity threats. keywords: exposure score, Microsoft Defender for Endpoint exposure score, Microsoft Defender for Endpoint tvm exposure score, organization exposure score, tvm organization exposure score, threat and vulnerability management, Microsoft Defender for Endpoint, mdvm, Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Hunt Exposed Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-hunt-exposed-devices.md | Title: Hunt for exposed devices description: Learn how Microsoft Defender Vulnerability Management can be used to help security admins, IT admins, and SecOps collaborate. keywords: Microsoft Defender for Endpoint-tvm scenarios, Microsoft Defender for Endpoint, tvm, tvm scenarios, reduce threat & vulnerability exposure, reduce threat and vulnerability, improve security configuration, increase Microsoft Secure Score for Devices, increase threat & vulnerability Microsoft Secure Score for Devices, Microsoft Secure Score for Devices, exposure score, security controls,Microsoft Defender Vulnerability Management, mdvm++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Manage Log4shell Guidance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-manage-Log4shell-guidance.md | Title: Learn how to mitigate the Log4Shell vulnerability in Microsoft Defender for Endpoint - Defender Vulnerability Management description: Learn how to mitigate the Log4Shell vulnerability in Microsoft Defender for Endpoint keywords: tvm, lo4j, mdvm++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Microsoft Secure Score Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-microsoft-secure-score-devices.md | Title: Microsoft Secure Score for Devices description: Your score for devices shows the collective security configuration state of your devices across application, operating system, network, accounts, and security controls. keywords: Microsoft Secure Score for Devices, Microsoft Defender for Endpoint Microsoft Secure Score for Devices, secure score, configuration score, threat and vulnerability management, security controls, improvement opportunities, security configuration score over time, security posture, baseline, Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Network Share Assessment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-network-share-assessment.md | Title: Network share configuration assessment description: Learn review recommendations related to network shares in your environment through vulnerability management. keywords: Microsoft Defender for Endpoint tvm, assessment tvm, threat & vulnerability management, vulnerable CVE, mdvm, Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Prerequisites | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-prerequisites.md | Title: Prerequisites & permissions for Microsoft Defender Vulnerability Management description: Before you begin using Microsoft Defender Vulnerability Management, make sure you have the relevant configurations and permissions. keywords: threat & vulnerability management permissions prerequisites, threat and vulnerability management permissions prerequisites, Microsoft Defender for Endpoint TVM permissions prerequisites, vulnerability management, mdvm, Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Remediation | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-remediation.md | Title: Remediate vulnerabilities description: Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in defender vulnerability management. keywords: Microsoft Defender for Endpoint tvm remediation, Microsoft Defender for Endpoint tvm, threat and vulnerability management, threat & vulnerability management, threat & vulnerability management remediation, tvm remediation intune, tvm remediation sccm, Microsoft Defender Vulnerability Management, mdvm++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Security Baselines | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-security-baselines.md | Title: Security baselines assessment description: Find out about the security baselines in your environment keywords: Microsoft Defender for Endpoint security baselines, mdvm, threat & vulnerability management, Microsoft Defender Vulnerability Management, Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Security Recommendation | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-security-recommendation.md | Title: Security recommendations description: Get actionable security recommendations prioritized by threat, likelihood to be breached, and value, in vulnerability management. keywords: vulnerability management, Microsoft Defender for Endpoint tvm security recommendation, Microsoft Defender Vulnerability Management recommendation, tvm security recommendation cybersecurity recommendation, actionable security recommendation++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Software Inventory | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-software-inventory.md | Title: Software inventory in Defender Vulnerability Management description: The software inventory page for Microsoft Defender for Endpoint's Vulnerability Management shows how many weaknesses and vulnerabilities have been detected in software. keywords: threat and vulnerability management, Microsoft Defender for Endpoint, Microsoft Defender for Endpoint software inventory, Microsoft Defender for Endpoint threat & vulnerability management, Microsoft Defender for Endpoint threat & vulnerability management software inventory, Microsoft Defender for Endpoint tvm software inventory, tvm software inventory, Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Supported Os | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-supported-os.md | Title: Supported operating systems platforms and capabilities description: Ensure that you meet the operating system or platform requisites for Microsoft Defender Vulnerability Management, so the activities in your all devices are properly accounted for. keywords: threat & vulnerability management, threat and vulnerability management, operating system, platform requirements, prerequisites, Microsoft Defender for Endpoint-tvm supported os, Microsoft Defender for Endpoint-tvm, supported operating systems, supported platforms, linux support, mac support, mdvm, Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Vulnerable Devices Report | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-vulnerable-devices-report.md | Title: Vulnerable devices report description: A report showing vulnerable device trends and current statistics so you can understand the breath and scope of your device exposure. keywords: Microsoft Defender for Endpoint-tvm vulnerable devices, Microsoft Defender for Endpoint, tvm, reduce threat & vulnerability exposure, reduce threat and vulnerability, monitor security configuration, Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Weaknesses | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-weaknesses.md | Title: Vulnerabilities in my organization description: Lists the common vulnerabilities and exposures (CVE) ID of weaknesses found in the software running in your organization. Discovered by the Microsoft Defender vulnerability management capabilities. keywords: Microsoft Defender for Endpoint threat & vulnerability management, threat and vulnerability management, Microsoft Defender for Endpoint tvm weaknesses page, finding weaknesses through tvm, tvm vulnerability list, vulnerability details in tvm, Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tvm Zero Day Vulnerabilities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-zero-day-vulnerabilities.md | Title: Mitigate zero-day vulnerabilities description: Learn how to find and mitigate zero-day vulnerabilities in your environment through Microsoft Defender Vulnerability Management. keywords: Microsoft Defender for Endpoint tvm zero day vulnerabilities, tvm, threat & vulnerability management, zero day, 0-day, mitigate 0 day vulnerabilities, vulnerable CVE, mdvm, Microsoft Defender Vulnerability Management++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Whats New In Microsoft Defender Vulnerability Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/whats-new-in-microsoft-defender-vulnerability-management.md | Title: What's new in Microsoft Defender Vulnerability Management Public Preview description: See what features are available in the latest release of Microsoft Defender for Vulnerability Management public preview. keywords: what's new in Microsoft Defender for Endpoint, ga, generally available, capabilities, available, new search.appverid: met150++ ms.mktglfcycl: secure ms.sitesec: library ms.pagetype: security audience: ITPro - m365-security-compliance # What's new in Microsoft Defender Vulnerability Management Public Preview |
| security | Advanced Hunting Aadsignineventsbeta Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-aadsignineventsbeta-table.md | description: Learn about the Azure Active Directory sign-in events table of the keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, file, IP address, device, machine, user, account, identity, AAD search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Aadspnsignineventsbeta Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-aadspnsignineventsbeta-table.md | Title: AADSpnSignInEventsBeta table in the advanced hunting schema description: Learn about information associated with Azure Active Directory's service principal and managed identity sign-in events table. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Alertevidence Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-alertevidence-table.md | description: Learn about information associated with alerts in the AlertEvidence keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, AlertInfo, alert, entities, evidence, file, IP address, device, machine, user, account search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Alertinfo Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-alertinfo-table.md | description: Learn about alert generation events in the AlertInfo table of the a keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, AlertInfo, alert, severity, category, MITRE, ATT&CK, Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Cloud App Security, MCAS, and Microsoft Defender for Identity search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Assignedipaddresses Function | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-assignedipaddresses-function.md | description: Learn how to use the AssignedIPAddresses() function to get the late keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, FileProfile, file profile, function, enrichment search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Best Practices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-best-practices.md | description: Learn how to construct fast, efficient, and error-free threat hunti keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema, kusto, avoid timeout, command lines, process id, optimize, best practice, parse, join, summarize search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Cloudappevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-cloudappevents-table.md | description: Learn about events from cloud apps and services in the CloudAppEven keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, CloudAppEvents, Defender for Cloud Apps search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Deviceevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-deviceevents-table.md | description: Learn about antivirus, firewall, and other event types in the misce keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, security events, antivirus, firewall, exploit guard, DeviceEvents search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Devicefilecertificateinfo Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicefilecertificateinfo-table.md | description: Learn about file signing information in the DeviceFileCertificateIn keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, digital signature, certificate, file signing, DeviceFileCertificateInfo search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Devicefileevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicefileevents-table.md | description: Learn about file-related events in the DeviceFileEvents table of th keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, filecreationevents, DeviceFileEvents, files, path, hash, sha1, sha256, md5 search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro - # DeviceFileEvents |
| security | Advanced Hunting Devicefromip Function | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicefromip-function.md | description: Learn how to use the DeviceFromIP() function to get the devices tha keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, device, devicefromIP, function, enrichment search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Deviceimageloadevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-deviceimageloadevents-table.md | description: Learn about DLL loading events in the DeviceImageLoadEvents table o keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, imageloadevents, DeviceImageLoadEvents, DLL loading, library, file image search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Deviceinfo Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-deviceinfo-table.md | description: Learn about OS, computer name, and other machine information in the keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, machineinfo, DeviceInfo, device, machine, OS, platform, users search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Devicelogonevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicelogonevents-table.md | description: Learn about authentication or sign-in events in the DeviceLogonEven keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, logonevents, DeviceLogonEvents, authentication, logon, sign in search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Devicenetworkevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicenetworkevents-table.md | description: Learn about network connection events you can query from the Device keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, devicenetworkevents, NetworkCommunicationEvents, network connection, remote ip, local ip search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Devicenetworkinfo Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicenetworkinfo-table.md | description: Learn about network configuration information in the DeviceNetworkI keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, machinenetworkinfo, DeviceNetworkInfo, device, machine, mac, ip, adapter, dns, dhcp, gateway, tunnel search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Deviceprocessevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-deviceprocessevents-table.md | description: Learn about the process spawning or creation events in the DevicePr keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, processcreationevents, DeviceProcessEvents, process id, command line, DeviceProcessEvents search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Deviceregistryevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-deviceregistryevents-table.md | description: Learn about registry events you can query from the DeviceRegistryEv keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, registryevents, registry, DeviceRegistryEvents, key, subkey, value search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Devicetvminfogathering Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicetvminfogathering-table.md | description: Learn about the assessment events including the status of various c keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities, Microsoft Defender Vulnerability Management search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Devicetvminfogatheringkb Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicetvminfogatheringkb-table.md | description: Learn about the metadata for assessment events in the DeviceTvmInfo keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities, MDVM search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Devicetvmsecureconfigurationassessment Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicetvmsecureconfigurationassessment-table.md | description: Learn about security assessment events in the DeviceTvmSecureConfig keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, DeviceTvmSecureConfigurationAssessment search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Devicetvmsecureconfigurationassessmentkb Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md | description: Learn about the various secure configurations assessed by Microsoft keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, MITRE ATT&CK framework, knowledge base, KB, DeviceTvmSecureConfigurationAssessmentKB, MDVM, Microsoft Defender Vulnerability Management search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Devicetvmsoftwareevidencebeta Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicetvmsoftwareevidencebeta-table.md | description: Learn how to use the DeviceTvmSoftwareEvidenceBeta table in the adv keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, evidence, software evidence, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareEvidenceBeta search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Devicetvmsoftwareinventory Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicetvmsoftwareinventory-table.md | description: Learn about the inventory of software in your devices in the Device keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Devicetvmsoftwarevulnerabilities Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicetvmsoftwarevulnerabilities-table.md | description: Learn about the software vulnerabilities found on devices and the l keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Devicetvmsoftwarevulnerabilitieskb Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md | description: Learn about the software vulnerabilities tracked by Microsoft Defen keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema, reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, CVSS, DeviceTvmSoftwareVulnerabilitiesKB search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Emailattachmentinfo Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-emailattachmentinfo-table.md | description: Learn about email attachment information in the EmailAttachmentInfo keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, EmailAttachmentInfo, network message id, sender, recipient, attachment id, attachment name, malware verdict search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Emailevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-emailevents-table.md | description: Learn about events associated with Microsoft 365 emails in the Emai keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, EmailEvents, network message id, sender, recipient, attachment id, attachment name, malware verdict, phishing verdict, attachment count, link count, url count search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Emailpostdeliveryevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-emailpostdeliveryevents-table.md | description: Learn about post-delivery actions taken on Microsoft 365 emails in keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, EmailPostDeliveryEvents, network message id, sender, recipient, attachment id, attachment name, malware verdict, phishing verdict, attachment count, link count, url count search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Emailurlinfo Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-emailurlinfo-table.md | description: Learn about URL or link information in the EmailUrlInfo table of th keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, EmailUrlInfo, network message id, url, link search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Errors | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-errors.md | description: Understand errors displayed when using advanced hunting keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema, kusto, timeout, resources, errors, unknown error, limits, quota, parameter, allocation search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Example | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-example.md | description: Get started searching for email threats using advanced hunting keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, custom detections, schema, kusto search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Expert Training | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-expert-training.md | description: Free training and guidance from advanced hunting experts keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, language, training, scenarios, basic to advanced, videos, step-by-step search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Extend Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-extend-data.md | description: Check auditing settings on Windows devices and other settings to he keywords: advanced hunting, incident, pivot, entity, audit settings, user account management, security group management, threat hunting, cyber threat hunting, search, query, telemetry, Microsoft 365, Microsoft 365 Defender search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Fileprofile Function | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-fileprofile-function.md | description: Learn how to use the FileProfile() to enrich information about file keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, FileProfile, file profile, function, enrichment search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Find Ransomware | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-find-ransomware.md | description: Use advanced hunting to locate devices potentially affected by rans keywords: advanced hunting, ransomware, threat hunting, cyber threat hunting, search, query, telemetry, Microsoft 365, Microsoft 365 Defender search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Hunt for ransomware |
| security | Advanced Hunting Go Hunt | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-go-hunt.md | description: Learn how to use the go hunt tool on to quickly query for relevant keywords: advanced hunting, incident, pivot, entity, go hunt, relevant events, threat hunting, cyber threat hunting, search, query, telemetry, Microsoft 365, Microsoft 365 Defender search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Identitydirectoryevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-identitydirectoryevents-table.md | description: Learn about domain controller and Active Directory events in the Id keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, IdentityDirectoryEvents, domain controller, Active Directory, Microsoft Defender for Identity, identities search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Identityinfo Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-identityinfo-table.md | description: Learn about user account information in the IdentityInfo table of t keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, AccountInfo, IdentityInfo, account search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Identitylogonevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-identitylogonevents-table.md | description: Learn about authentication events recorded by Active Directory in t keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, IdentityLogonEvents, Azure AD, Active Directory, Microsoft Defender for Identity, identities search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Identityqueryevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-identityqueryevents-table.md | description: Learn about Active Directory query events in the IdentityQueryEvent keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, IdentityQueryEvents, Azure AD, Active Directory, Microsoft Defender for Identity, identities, LDAP queries search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Limits | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-limits.md | description: Understand various quotas and usage parameters (service limits) tha keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema, kusto, CPU limit, query limit, resources, maximum results, quota, parameters, allocation search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Link To Incident | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-link-to-incident.md | description: Link query results to an incident keywords: advanced hunting, incident, pivot, entity, go hunt, relevant events, threat hunting, cyber threat hunting, search, query, telemetry, Microsoft 365, Microsoft 365 Defender search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Migrate From Mde | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-migrate-from-mde.md | description: Learn how to adjust your Microsoft Defender for Endpoint queries so keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, Microsoft Defender for Endpoint, search, query, telemetry, custom detections, schema, kusto, mapping search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Modes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-modes.md | Title: Choose between guided and advanced modes for hunting in Microsoft 365 Defender description: Guided hunting in Microsoft 365 Defender does not require KQL knowledge while advanced hunting allows you to write a query from scratch. keywords: guided mode, advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, custom detections, schema, kusto++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-overview.md | Title: Overview - Advanced hunting description: Learn about advanced hunting queries in Microsoft 365 and how to use them to proactively find threats and weaknesses in your network keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, custom detections, schema, kusto++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Query Builder Details | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-query-builder-details.md | description: Refine your query by using the different guided mode capabilities i keywords: guided mode, advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, custom detections, schema, kusto search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Query Builder Results | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-query-builder-results.md | description: Use and customize query results in guided mode for advanced hunting keywords: guided mode, advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, custom detections, schema, kusto search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Query Builder | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-query-builder.md | description: Learn how to build queries in guided mode by combining different av keywords: guided mode, advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, custom detections, schema, kusto search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Query Emails Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-query-emails-devices.md | description: Study common hunting scenarios and sample queries that cover device keywords: advanced hunting, Office365 data, Windows devices, Office365 emails normalize, emails, apps, identities, threat hunting, cyber threat hunting, search, query, telemetry, Microsoft 365, Microsoft 365 Defender search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Query Language | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-query-language.md | description: Create your first threat hunting query and learn about common opera keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, language, learn, first query, telemetry, events, telemetry, custom detections, schema, kusto, operators, data types, powershell download, query example search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Query Results | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-query-results.md | description: Make the most of the query results returned by advanced hunting in keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, custom detections, schema, kusto, visualization, chart, filters, drill-down search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Schema Changes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-schema-changes.md | description: Track and review naming changes tables and columns in the advanced keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, data, naming changes, rename search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Schema Tables | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-schema-tables.md | description: Learn about the tables in the advanced hunting schema to understand keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, data search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Seenby Function | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-seenby-function.md | description: Learn how to use the SeenBy() function to look for which onboarded keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, SeenBy, device discovery, function, enrichment search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Shared Queries | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-shared-queries.md | description: Start threat hunting immediately with predefined and shared queries keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, custom detections, schema, kusto, github repo, my queries, shared queries search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Advanced Hunting Take Action | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-take-action.md | description: Quickly address threats and affected assets in your advanced huntin keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, take action search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security To learn more about how quarantine actions are taken and how files can be restor To take any of the described actions, select one or more records in your query results and then select **Take actions**. A wizard will guide you through the process of selecting and then submitting your preferred actions. ## Take various actions on emails Apart from device-focused remediation steps, you can also take some actions on emails from your query results. Select the records you want to take action on, select **Take actions**, then under **Choose actions**, select your choice from the following: - `Move to mailbox folder` - select this to move the email messages to Junk, Inbox, or Deleted items folder - :::image type="content" source="../../media/advanced-hunting-take-actions-email.png" alt-text="The Take actions option in the Microsoft 365 Defender portal" lightbox="../../media/advanced-hunting-take-actions-email.png"::: + :::image type="content" source="../../media/advanced-hunting-take-actions-email.png" alt-text="The option Take actions in the Microsoft 365 Defender portal" lightbox="../../media/advanced-hunting-take-actions-email.png"::: - `Delete email` - select this to move email messages to the Deleted items folder (**Soft delete**) or delete them permanently (**Hard delete**) |
| security | Advanced Hunting Urlclickevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-urlclickevents-table.md | description: Learn how to hunt for phishing campaigns and suspicious clicks usin keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, UrlClickEvents, SafeLinks, phishing, malware, malicious clicks, outlook, teams, email, office365 search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Alert Grading For Malicious Exchange Connectors | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/alert-grading-for-malicious-exchange-connectors.md | Title: Alert grading for malicious exchange connectors description: Alert grading recipients from malicious exchange connectors activity and protect their network from malicious attack. keywords: incidents, alerts, investigate, analyze, response, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Alert Grading Password Spray | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/alert-grading-password-spray.md | Title: Suspicious password-spray-related IP address activity alert description: Alert grading for suspicious password-spray-related IP address activity to review the alerts and take recommended actions to remediate the attack and protect your network. keywords: incidents, alerts, investigate, analyze, response, correlation, attack, devices, users, 365, microsoft, m365, password, spray, alert classification, alert grading, cloud apps, suspicious IP++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Alert Grading Playbook Email Forwarding | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/alert-grading-playbook-email-forwarding.md | Title: Alert grading for suspicious email forwarding activity description: Alert grading for suspicious email forwarding activity to review the alerts and take recommended actions to remediate the attack and protect your network. keywords: incidents, alerts, investigate, analyze, response, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Alert Grading Playbook Inbox Forwarding Rules | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/alert-grading-playbook-inbox-forwarding-rules.md | Title: Alert grading for suspicious inbox forwarding rules description: Alert grading for suspicious inbox forwarding rules to review the alerts and take recommended actions to remediate the attack and protect your network. keywords: incidents, alerts, investigate, analyze, response, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Alert Grading Playbook Inbox Manipulation Rules | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/alert-grading-playbook-inbox-manipulation-rules.md | Title: Alert grading for suspicious inbox manipulation rules description: Alert grading for suspicious inbox manipulation rules to review the alerts and take recommended actions to remediate the attack and protect your network. keywords: incidents, alerts, investigate, analyze, response, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Alert Grading Playbooks | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/alert-grading-playbooks.md | Title: Alert grading playbooks description: Review the alerts for well-known attacks and take recommended actions to remediate the attack and protect your network. keywords: incidents, alerts, investigate, analyze, response, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365 search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Api Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-access.md | Title: Access the Microsoft 365 Defender APIs description: Learn how to access the Microsoft 365 Defender APIs keywords: access, apis, application context, user context, aad application, access token search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Api Advanced Hunting | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-advanced-hunting.md | Title: Microsoft 365 Defender advanced hunting API description: Learn how to run advanced hunting queries using Microsoft 365 Defender's advanced hunting API keywords: Advanced Hunting, APIs, api, M365 Defender, Microsoft 365 Defender search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Api Articles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-articles.md | Title: Other security and threat protection APIs description: View a list of APIs related to Microsoft security and threat protection products. keywords: api, security, threat protection, mde, Microsoft Defender for Endpoint, Microsoft Defender for Office 365, cloud app security search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Api Create App User Context | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-create-app-user-context.md | Title: Create an app to access Microsoft 365 Defender APIs on behalf of a user description: Learn how to access Microsoft 365 Defender APIs on behalf of a user. keywords: access, on behalf of user, api, application, user, access token, token, search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Api Create App Web | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-create-app-web.md | Title: Create an app to access Microsoft 365 Defender without a user description: Learn how to create an app to access Microsoft 365 Defender without a user. keywords: app, access, api, create search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Api Error Codes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-error-codes.md | Title: Common Microsoft 365 Defender REST API error codes description: Learn about the common Microsoft 365 Defender REST API error codes keywords: api, error, codes, common errors, Microsoft 365 Defender, api error codes search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Api Get Incident | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-get-incident.md | Title: Get incident API description: Learn how to use the Get incidents API to get a single incident in Microsoft 365 Defender. keywords: apis, graph api, supported apis, get, file, hash search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Api Hello World | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-hello-world.md | Title: Hello World for Microsoft 365 Defender REST API description: Learn how to create an app and use a token to access the Microsoft 365 Defender APIs keywords: app, token, access, aad, app, application registration, powershell, script, global administrator, permission, microsoft 365 defender search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Api Incident | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-incident.md | Title: Microsoft 365 Defender incidents APIs and the incidents resource type description: Learn about the methods and properties of the Incidents resource type in Microsoft 365 Defender keywords: incident, incidents, api search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Api List Incidents | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-list-incidents.md | Title: List incidents API in Microsoft 365 Defender description: Learn how to list incidents API in Microsoft 365 Defender keywords: list, incident, incidents, api search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Api Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-overview.md | Title: Overview of Microsoft 365 Defender APIs description: Learn about the available APIs in Microsoft 365 Defender keywords: api, apis, overview, incident, incidents, threat hunting, microsoft 365 defender search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Api Partner Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-partner-access.md | Title: Partner access through Microsoft 365 Defender APIs description: Learn how to create an app to get programmatic access to Microsoft 365 Defender on behalf of your users. keywords: partner, access, api, multi tenant, consent, access token, app search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Api Supported | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-supported.md | Title: Supported Microsoft 365 Defender APIs description: Supported Microsoft 365 Defender APIs keywords: Microsoft 365 Defender, APIs, api search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Api Update Incidents | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-update-incidents.md | Title: Update incident API description: Learn how to update incidents using Microsoft 365 Defender API keywords: update, api, incident search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Before You Begin Defender Experts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/before-you-begin-defender-experts.md | |
| security | Configure Event Hub | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/configure-event-hub.md | description: Learn how to configure your Event Hubs keywords: event hub, configure, insights search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro # Configure your Event Hubs |
| security | Configure Microsoft Threat Experts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/configure-microsoft-threat-experts.md | description: Subscribe to Microsoft Threats Experts through Microsoft 365 Defend keywords: Microsoft Threat Experts, managed threat hunting service, MTE, Microsoft managed hunting service search.product: Windows 10 search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro - M365-security-compliance - m365initiative-m365-defender |
| security | Configure Siem Defender | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/configure-siem-defender.md | description: Learn how to use REST API and configure supported security informat keywords: configure siem, security information and events management tools, splunk, arcsight, custom indicators, rest api, alert definitions, indicators of compromise search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Custom Detection Rules | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/custom-detection-rules.md | description: Learn how to create and manage custom detections rules based on adv keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, custom detections, rules, schema, kusto, RBAC, permissions, Microsoft Defender for Endpoint search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Custom Detections Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/custom-detections-overview.md | description: Understand how you can use advanced hunting to create custom detect keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, custom detections, schema, kusto search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Custom Roles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/custom-roles.md | Title: Custom roles for role-based access control description: Learn how to manage custom roles in the Microsoft 365 Defender portal keywords: access, permissions, Microsoft 365 Defender, M365, security, MCAS, Cloud App Security, Microsoft Defender for Endpoint, scope, scoping, RBAC, roles-based access, custom roles-based access, roles-based auth, RBAC in MDO, roles, rolegroups, permissions inheritance, fine-grained permissions search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Data Privacy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/data-privacy.md | Title: Microsoft 365 Defender data security and privacy description: Describes the privacy and data security of the service. keywords: privacy, data, security, trust center, information collection search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Defender Experts For Hunting | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/defender-experts-for-hunting.md | |
| security | Defender Experts Report | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/defender-experts-report.md | description: The Defender Experts for Hunting service publishes monthly reports keywords: analyst report, defender experts report, detections, defender expert notification, hunting, notifications, threat categories, hunting reports search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Deploy Supported Services | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/deploy-supported-services.md | Title: Deploy services supported by Microsoft 365 Defender description: Learn about the Microsoft security services that can be integrated by Microsoft 365 Defender, their licensing requirements, and deployment procedures keywords: deploy, licenses, supported services, provisioning, configuration Microsoft 365 Defender, M365, license eligibility, Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Cloud App Security, MCAS, E5, A5, EMS search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro - M365-security-compliance - m365solution-getstarted+ - highpri search.appverid: - MOE150 - MET150 # Deploy supported services |
| security | Device Profile | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/device-profile.md | Title: Device profile in Microsoft 365 security portal description: View risk and exposure levels for a device in your organization. Analyze past and present threats, and protect the device with the latest updates. keywords: security, malware, Microsoft 365, M365, Microsoft 365 Defender, security center, Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, device page, device profile, machine page, machine profile++ ms.mktglfcycl: deploy ms.localizationpriority: medium audience: ITPro search.appverid: met150 # Device profile page |
| security | Eval Create Eval Environment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-create-eval-environment.md | Title: Create the Microsoft 365 Defender Evaluation Environment for greater cybe description: Learn what's included in the Microsoft 365 Defender XDR you will evaluate, and se up your Microsoft 365 Defender trial lab or pilot environment by activating trial licenses. Start your XDR cyber security journey here and learn how to take that test to production. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Step 1. Create the Microsoft 365 Defender Evaluation Environment for greater cyber security |
| security | Eval Defender Endpoint Architecture | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-endpoint-architecture.md | Title: Review Microsoft Defender for Endpoint architecture requirements and key description: The technical diagram for Microsoft Defender for Endpoint in Microsoft 365 Defender will help you understand identity in Microsoft 365 before you build your trial lab or pilot environment. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Review Microsoft Defender for Endpoint architecture requirements and key concepts |
| security | Eval Defender Endpoint Enable Eval | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-endpoint-enable-eval.md | Title: Enable Microsoft Defender for Endpoint evaluation description: Enable your Microsoft 365 Defender trial lab or pilot environment, including checking license state, and onboarding endpoints search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Enable Microsoft Defender for Endpoint evaluation environment |
| security | Eval Defender Endpoint Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-endpoint-overview.md | Title: Step 4. Evaluate Microsoft Defender for Endpoint overview, including reviewing the architecture -description: Steps for the set up for a Microsoft 365 Defender trial lab or pilot environment. Test and experience how the security solution is designed to protect devices, identity, data, and apps in your organization. +description: Steps for the setup of a Microsoft 365 Defender trial lab or pilot environment. Test and experience how the security solution is designed to protect devices, identity, data, and apps in your organization. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Step 4. Evaluate Microsoft Defender for Endpoint overview ms.technology: m365d - Microsoft 365 Defender -This article outlines the process to enable and pilot Microsoft Defender for Endpoint. Before starting this process, be sure you've reviewed the overall process for [evaluating Microsoft 365 Defender](eval-overview.md) and you have [created the Microsoft 365 Defender evaluation environment](eval-create-eval-environment.md). +This article outlines the process to enable and pilot Microsoft Defender for Endpoint. Before starting this process, be sure you've reviewed the overall process for [evaluating Microsoft 365 Defender](eval-overview.md), and you've [created the Microsoft 365 Defender evaluation environment](eval-create-eval-environment.md). <br> Use the following steps to enable and pilot Microsoft Defender for Endpoint. The following table describes the steps in the illustration. |Step |Description ||| | [Step 1. Review architecture requirements and key concepts](eval-defender-endpoint-architecture.md) | Understand the Defender for Endpoint architecture and the capabilities available to you. |-|[Step 2. Enable the evaluation environment](eval-defender-endpoint-enable-eval.md) | Follow the steps to setup the evaluation environment. | +|[Step 2. Enable the evaluation environment](eval-defender-endpoint-enable-eval.md) | Follow the steps to set up the evaluation environment. | |[Step 3. Set up the pilot ](eval-defender-endpoint-pilot.md) | Verify your pilot group, run simulations, and become familiar with key features and dashboards. | |
| security | Eval Defender Endpoint Pilot | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-endpoint-pilot.md | Title: Pilot Microsoft Defender for Endpoint description: Learn how to run a pilot for Microsoft Defender for Endpoint(MDE), including verifying the pilot group and trying out capabilities. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Pilot Microsoft Defender for Endpoint |
| security | Eval Defender Identity Architecture | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-identity-architecture.md | Title: Review architecture requirements and the technical framework for Microsof description: The technical diagram for Microsoft Defender for Identity in Microsoft 365 Defender will help you understand identity in Microsoft 365 before you build your trial lab or pilot environment. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Review architecture requirements and key concepts for Microsoft Defender for Identity |
| security | Eval Defender Identity Enable Eval | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-identity-enable-eval.md | Title: Enable the evaluation environment for Microsoft Defender for Identity description: Set up Microsoft Defender for Identity in Microsoft 365 Defender trial lab or pilot environment by installing & configuring the sensor, and discovering local admins on other computers. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Enable the evaluation environment for Microsoft Defender for Identity |
| security | Eval Defender Identity Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-identity-overview.md | Title: Step 2. An Overview of Microsoft 365 Defender for Identity evaluation description: Use Microsoft 365 Defender for Identity in your Microsoft 365 Defender XDR solution. Steps for the evaluation of Microsoft 365 Defender for Identity including requirements, enabling or activating the eval, and set up of the pilot or test. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Step 2. Evaluate Microsoft Defender for Identity overview |
| security | Eval Defender Identity Pilot | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-identity-pilot.md | Title: Pilot Microsoft Defender for Identity description: Pilot Microsoft Defender for Identity, set benchmarks, take tutorials on reconnaissance, compromised credential, lateral movement, domain dominance, and exfiltration alerts, among others. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Pilot Microsoft Defender for Identity |
| security | Eval Defender Investigate Respond Additional | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-investigate-respond-additional.md | description: Try incident response capabilities in Microsoft 365 Defender to pri keywords: Microsoft 365 Defender trial, try Microsoft 365 Defender, evaluate Microsoft 365 Defender, Microsoft 365 Defender evaluation lab, Microsoft 365 Defender pilot, cyber security, advanced persistent threat, enterprise security, devices, device, identity, users, data, applications, incidents, automated investigation and remediation, advanced hunting search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Try Microsoft 365 Defender incident response capabilities in a pilot environment |
| security | Eval Defender Investigate Respond Simulate Attack | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-investigate-respond-simulate-attack.md | Title: Run an attack simulation in a Microsoft 365 Defender pilot environment description: Run attack simulations for Microsoft 365 Defender to see how alerts and incidents are presented, insights are gained, and threats are quickly remediated. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Run an attack simulation in a Microsoft 365 Defender pilot environment |
| security | Eval Defender Investigate Respond | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-investigate-respond.md | Title: Investigate and respond using Microsoft 365 Defender in a pilot environme description: Set up attack simulations in Microsoft 365 Defender trial lab or pilot environment to try out the security solution designed to teach users to protect devices, identity, data, and applications. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Step 6. Investigate and respond using Microsoft 365 Defender in a pilot environment |
| security | Eval Defender Mcas Architecture | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-mcas-architecture.md | Title: Review architecture requirements and the structure for Microsoft Defender description: Microsoft Defender for Cloud Apps technical diagrams explain the architecture in Microsoft 365 Defender, which will help you build a pilot environment. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Review architecture requirements and key concepts for Microsoft Defender for Cloud Apps |
| security | Eval Defender Mcas Enable Eval | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-mcas-enable-eval.md | Title: Enable the evaluation environment for Microsoft Defender for Cloud Apps description: Learn the architecture of Defender for Cloud Apps within Microsoft Defender for Office 365 and understand interactions between the Microsoft 365 Defender products. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Enable the evaluation environment for Microsoft Defender for Cloud Apps |
| security | Eval Defender Mcas Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-mcas-overview.md | Title: Step 5. Evaluate Microsoft Defender for Cloud Apps overview description: Steps to set up your Microsoft 365 Defender trial lab or pilot environment to try out and experience the security solution designed to protect devices, identity, data, and applications in your organization. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Step 5. Evaluate Microsoft Defender for Cloud Apps |
| security | Eval Defender Mcas Pilot | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-mcas-pilot.md | Title: Pilot Microsoft Defender for Cloud Apps with Microsoft 365 Defender description: Set up your Microsoft 365 Defender trial lab or pilot environment to test and experience the security solution designed to protect devices, identity, data, and applications. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Pilot Microsoft Defender for Cloud Apps with Microsoft 365 Defender |
| security | Eval Defender Office 365 Architecture | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-office-365-architecture.md | Title: Review architecture requirements and planning concepts for Microsoft Defe description: The technical diagram for Microsoft Defender for Office 365 in Microsoft 365 Defender will help you understand identity at Microsoft 365 before you build your trial lab or pilot environment. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Review Microsoft Defender for Office 365 architecture requirements and key concepts |
| security | Eval Defender Office 365 Enable Eval | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-office-365-enable-eval.md | Title: Enable the evaluation environment for Microsoft Defender for Office 365 i description: Steps to activate Microsoft Defender for Office 365 evaluation, with trial licenses, MX record handling, & auditing of accepted domains and inbound connections. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Enable the evaluation environment |
| security | Eval Defender Office 365 Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-office-365-overview.md | Title: Step 3. Evaluate Microsoft Defender for Office 365 overview description: Use this overview to learn the steps to set up an MDO pilot, including requirements, enabling or activating the eval, and setting up the pilot. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Step 3. Enable and pilot Microsoft Defender for Office 365 ms.technology: m365d **Applies to:** - Microsoft 365 Defender -This article outlines the process to enable and pilot Microsoft Defender for Office 365. Before starting this process, be sure you've reviewed the overall process for [evaluating Microsoft 365 Defender](eval-overview.md) and you have [created the Microsoft 365 Defender evaluation environment](eval-create-eval-environment.md). +This article outlines the process to enable and pilot Microsoft Defender for Office 365. Before starting this process, be sure you've reviewed the overall process for [evaluating Microsoft 365 Defender](eval-overview.md), and you've [created the Microsoft 365 Defender evaluation environment](eval-create-eval-environment.md). <br> Use the following steps to enable and pilot Microsoft Defender for Office 365. The following table describes the steps in the illustration. | Step number | Link |Description | |||| |1|[Review architecture requirements and key concepts](eval-defender-office-365-architecture.md) | Understand the Defender for Office architecture and be sure your Exchange Online environment meets the architecture prerequisites. |-|2|[Enable the evaluation environment](eval-defender-office-365-enable-eval.md) | Follow the steps to setup the evaluation environment. | +|2|[Enable the evaluation environment](eval-defender-office-365-enable-eval.md) | Follow the steps to set up the evaluation environment. | |3|[Set up the pilot ](eval-defender-office-365-pilot.md) | Create pilot groups, configure protection, and become familiar with key features and dashboards. | |
| security | Eval Defender Office 365 Pilot | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-office-365-pilot.md | Title: Pilot Microsoft Defender for Office 365, use the evaluation in your produ description: Steps to pilot your Evaluation with groups of active and existing users in order to properly test the features of Microsoft Defender for Office 365. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Pilot Microsoft Defender for Office 365 |
| security | Eval Defender Promote To Production | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-promote-to-production.md | Title: Step 7. Promote your Microsoft 365 Defender evaluation environment to Pro description: Use this article to promote your evals of MDI, MDO, MDE, and Defender for Cloud Apps to your live environment in Microsoft 365 Defender or M365D. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Step 7. Promote your Microsoft 365 Defender evaluation environment to production |
| security | Eval Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-overview.md | Title: Evaluate and pilot Microsoft 365 Defender, an XDR solution description: What is XDR security? How can you evaluate a Microsoft XDR in Microsoft 365 Defender? Use this blog series to plan your Microsoft 365 Defender trial lab or pilot environment to test and pilot a security solution designed to protect devices, identity, data, and applications. Start your XDR cyber security journey here and take that test to production. search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Evaluate and pilot Microsoft 365 Defender |
| security | Export Incidents Queue | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/export-incidents-queue.md | Title: Export incidents queue to CSV files description: Learn about the newly introduced Export button to migrate incidents queue-related data to CSV files keywords: incident, queue, export, csv search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Feedback | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/feedback.md | Title: Provide feedback on Microsoft 365 Defender description: Provide product feedback on Microsoft 365 Defender keywords: feedback, m365 security, security, 365, capabilities search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Fetch Incidents | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/fetch-incidents.md | description: Learn how to fetch Microsoft 365 Defender incidents from a customer keywords: managed security service provider, mssp, configure, integration search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | First Incident Analyze | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/first-incident-analyze.md | Title: Step 1. Triage and analyze your first incident description: How to triage and begin the analysis of your first incident in Microsoft 365 Defender. keywords: incidents, alerts, investigate, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365, incident response, cyber-attack search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro - M365-security-compliance - m365solution-firstincident+ - highpri search.appverid: - MOE150 - MET150 # Step 1. Triage and analyze your first incident |
| security | First Incident Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/first-incident-overview.md | Title: Responding to your first incident description: The basics of responding to your first incident in Microsoft 365 Defender. keywords: incidents, alerts, investigate, correlation, attack, devices, users, identities, identity, mailbox, email, 365, microsoft, m365, incident response, cyber-attack, self-study, ramp up, ramp-up, onboard, incident responder search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro - M365-security-compliance - m365solution-firstincident+ - highpri search.appverid: - MOE150 - MET150 # Responding to your first incident |
| security | First Incident Path Identity | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/first-incident-path-identity.md | Title: Example of an identity-based attack description: Step through an example analysis of an identity-based attack. keywords: incidents, alerts, investigate, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365, incident response, cyber-attack search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro - M365-security-compliance - m365solution-firstincident+ - highpri search.appverid: - MOE150 - MET150 # Example of an identity-based attack |
| security | First Incident Path Phishing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/first-incident-path-phishing.md | Title: Example of a phishing email attack description: Step through an example analysis of a phishing attack. keywords: incidents, alerts, investigate, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365 search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro - M365-security-compliance - m365solution-firstincident+ - highpri search.appverid: - MOE150 - MET150 # Example of a phishing email attack |
| security | First Incident Post | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/first-incident-post.md | Title: Step 3. Perform a post-incident review of your first incident description: How to perform a review of your first incident in Microsoft 365 Defender. keywords: incidents, alerts, investigate, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365 search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro - M365-security-compliance - m365solution-firstincident+ - highpri search.appverid: - MOE150 - MET150 # Step 3. Perform a post-incident review of your first incident |
| security | First Incident Prepare | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/first-incident-prepare.md | Title: Prepare your security posture for your first incident description: Set up your Microsoft 365 tenant's security posture for your first incident in Microsoft 365 Defender. keywords: incidents, alerts, investigate, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365 search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro - M365-security-compliance - m365solution-firstincident+ - highpri search.appverid: - MOE150 - MET150 # Prepare your security posture for your first incident |
| security | First Incident Remediate | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/first-incident-remediate.md | Title: Step 2. Remediate your first incident description: How to get started in remediating your first incident in Microsoft 365 Defender. keywords: incidents, alerts, investigate, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365, incident response, cyber-attack search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro - M365-security-compliance - m365solution-firstincident+ - highpri search.appverid: - MOE150 - MET150 # Step 2. Remediate your first incident |
| security | Get Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/get-started.md | description: Learn what steps you need to take to get started with Microsoft 365 keywords: get started, microsoft 365 defender, turn on, onboard, deploy search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro - M365-security-compliance - m365solution-getstarted+ - highpri # Get started with Microsoft 365 Defender |
| security | Incident Queue | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/incident-queue.md | Title: Prioritize incidents in Microsoft 365 Defender description: Learn how to filter incidents from the incident queue in Microsoft 365 Defender keywords: incident, queue, overview, devices, identities, users, mailbox, email, incidents, analyze, response, triage search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Incident Response Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/incident-response-overview.md | Title: Investigate and respond with Microsoft 365 Defender description: Investigate and respond to incidents with the capabilities of Microsoft 365 Defender. keywords: incidents, alerts, investigate, analyze, response, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365, incident response, cyberattack search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Incidents Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/incidents-overview.md | Title: Incident response with Microsoft 365 Defender description: Investigate incidents seen across devices, users, and mailboxes in the Microsoft 365 Defender portal. keywords: incidents, alerts, investigate, analyze, response, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365, incident response, cyber-attack search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Integrate Microsoft 365 Defender Secops Plan | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/integrate-microsoft-365-defender-secops-plan.md | Title: Step 1. Plan for Microsoft 365 Defender operations readiness description: The basics of planning for Microsoft 365 Defender operations readiness when integrating Microsoft 365 Defender into your security operations. keywords: incidents, alerts, investigate, correlation, attack, devices, users, identities, identity, mailbox, email, 365, microsoft, m365, incident response, cyber-attack, secops, security operations, soc search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Integrate Microsoft 365 Defender Secops Readiness | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/integrate-microsoft-365-defender-secops-readiness.md | Title: Step 2. Perform a SOC integration readiness assessment using the Zero Tru description: The basics of performing a SOC integration readiness assessment using the Zero Trust Framework when integrating Microsoft 365 Defender into your security operations. keywords: incidents, alerts, investigate, correlation, attack, devices, users, identities, identity, mailbox, email, 365, microsoft, m365, incident response, cyber-attack, secops, security operations, soc search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Integrate Microsoft 365 Defender Secops Roles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/integrate-microsoft-365-defender-secops-roles.md | Title: Step 4. Define Microsoft 365 Defender roles, responsibilities, and oversi description: The basics of defining roles, responsibilities, and oversight when integrating Microsoft 365 Defender into your security operations. keywords: incidents, alerts, investigate, correlation, attack, devices, users, identities, identity, mailbox, email, 365, microsoft, Microsoft 365, incident response, cyber-attack, secops, security operations, soc search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Integrate Microsoft 365 Defender Secops Services | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/integrate-microsoft-365-defender-secops-services.md | Title: Step 3. Plan for Microsoft 365 Defender integration with your SOC catalog description: The basics of integrating Microsoft 365 Defender into your security operations catalog of services. keywords: incidents, alerts, investigate, correlation, attack, devices, users, identities, identity, mailbox, email, 365, microsoft, m365, incident response, cyber-attack, secops, security operations, soc search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Integrate Microsoft 365 Defender Secops Tasks | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/integrate-microsoft-365-defender-secops-tasks.md | Title: Step 6. Identify SOC maintenance tasks description: Identify SOC maintenance tasks when integrating Microsoft 365 Defender into your security operations. keywords: incidents, alerts, investigate, correlation, attack, devices, users, identities, identity, mailbox, email, 365, microsoft, m365, incident response, cyber-attack, secops, security operations, soc search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Integrate Microsoft 365 Defender Secops Use Cases | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/integrate-microsoft-365-defender-secops-use-cases.md | Title: Step 5. Develop and test use cases description: The basics of developing and testing use cases when integrating Microsoft 365 Defender into your security operations. keywords: incidents, alerts, investigate, correlation, attack, devices, users, identities, identity, mailbox, email, 365, microsoft, m365, incident response, cyber-attack, secops, security operations, soc search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Integrate Microsoft 365 Defender Secops | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/integrate-microsoft-365-defender-secops.md | Title: Integrating Microsoft 365 Defender into your security operations description: The basics of integrating Microsoft 365 Defender into your security operations. keywords: incidents, alerts, investigate, correlation, attack, devices, users, identities, identity, mailbox, email, 365, microsoft, m365, incident response, cyber-attack, secops, security operations, soc search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Investigate Alerts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/investigate-alerts.md | Title: Investigate alerts in Microsoft 365 Defender description: Investigate alerts seen across devices, users, and mailboxes. keywords: incidents, alerts, investigate, analyze, response, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Investigate Dlp | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/investigate-dlp.md | description: Investigate data loss in Microsoft 365 Defender. keywords: Data Loss Prevention, incidents, alerts, investigate, analyze, response, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365 f1.keywords: - NOCSH++ ms.localizationpriority: medium |
| security | Investigate Incidents | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/investigate-incidents.md | Title: Investigate incidents in Microsoft 365 Defender description: Investigate incidents related to devices, users, and mailboxes. keywords: incident, incidents, analyze, response, machines, devices, users, identities, mail, email, mailbox, investigation, graph, evidence++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Investigate Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/investigate-users.md | Title: Investigate users in Microsoft 365 Defender description: Investigate users for an incident in the Microsoft 365 Defender portal. keywords: security, malware, Microsoft 365, M365, security center, monitor, report, identities, data, devices, apps, incident, analyze, response++ ms.mktglfcycl: deploy ms.localizationpriority: medium f1.keywords: |
| security | M365d Action Center | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-action-center.md | Title: Go to the Action center to view and approve your automated investigation description: Use the Action center to view details about automated investigation and approve pending actions keywords: Action center, threat protection, investigation, alert, pending, automated, detection search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | M365d Autoir Actions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-autoir-actions.md | Title: View and manage actions in the Action center description: Use the Action center to view and manage remediation actions keywords: action, center, autoair, automated, investigation, response, remediation search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | M365d Autoir Report False Positives Negatives | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-autoir-report-false-positives-negatives.md | Title: Address false positives or false negatives in Microsoft 365 Defender description: Was something missed or wrongly detected by AIR in Microsoft 365 Defender? Learn how to submit false positives or false negatives to Microsoft for analysis. keywords: automated, investigation, alert, remediation, false positive, false negative search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | M365d Autoir Results | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-autoir-results.md | Title: Details and results of an automated investigation description: View the results and key findings of automated investigation in Microsoft 365 Defender keywords: automated, investigation, results, analyze, details, remediation, autoair search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | M365d Autoir | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-autoir.md | Title: Automated investigation and response in Microsoft 365 Defender description: Get an overview of automated investigation and response capabilities, also called self-healing, in Microsoft 365 Defender keywords: automated, investigation, alert, trigger, action, remediation, self-healing search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | M365d Configure Auto Investigation Response | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-configure-auto-investigation-response.md | |
| security | M365d Enable Faq | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-enable-faq.md | Title: Frequently asked questions when turning on Microsoft 365 Defender description: Get answers to the most commonly asked questions about licensing, permissions, initial settings, and other products and services related to enabling Microsoft 365 Defender keywords: frequently asked questions, FAQ, GCC, get started, enable Microsoft 365 Defender, Microsoft 365 Defender, M365, security, data location, required permissions, license eligibility, settings page search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | M365d Enable | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-enable.md | Title: Turn on Microsoft 365 Defender description: Learn how to enable Microsoft 365 Defender and start integrating your security incident and response. keywords: get started, enable Microsoft 365 Defender, Microsoft 365 Defender, M365, security, data location, required permissions, license eligibility, settings page search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro - M365-security-compliance - m365solution-getstarted+ - highpri search.appverid: - MOE150 - MET150 # Turn on Microsoft 365 Defender |
| security | M365d Permissions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-permissions.md | Title: Manage access to Microsoft 365 Defender data in the Microsoft 365 Defende description: Learn how to manage permissions to data in Microsoft 365 Defender keywords: access, permissions, Microsoft 365 Defender, M365, security, MCAS, Cloud App Security, Microsoft Defender for Endpoint, scope, scoping, RBAC search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | M365d Remediation Actions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-remediation-actions.md | Title: Remediation actions in Microsoft 365 Defender description: Get an overview of remediation actions that follow automated investigations in Microsoft 365 Defender keywords: automated, investigation, alert, trigger, action, remediation search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | M365d Time Zone | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-time-zone.md | Title: Set the time zone for Microsoft 365 Defender features description: Learn how to choose the time zone for date and time information associated with incidents, automated investigation and remediation, and advanced hunting keywords: time zone, date, time, Microsoft 365 Defender, M365, security, incidents, automated investigation and response, AIR, advanced hunting search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Manage Incidents | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/manage-incidents.md | Title: Manage incidents in Microsoft 365 Defender description: Learn how to assign, update the status, keywords: incident, incidents, analyze, response, alerts, correlated alerts, assign, update, status, manage, classification, microsoft, 365, m365++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Microsoft 365 Defender Integration With Azure Sentinel | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-defender-integration-with-azure-sentinel.md | Title: Microsoft 365 Defender integration with Microsoft Sentinel description: Use Microsoft Sentinel as the SIEM for Microsoft 365 Defender incident and events. keywords: incidents, alerts, investigate, analyze, response, correlation, attack, machines, devices, users, identities, identity, mailbox, email, 365, microsoft, m365 search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Microsoft 365 Defender Portal | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-defender-portal.md | description: The Microsoft 365 Defender portal combines protection, detection, i keywords: introduction to MMicrosoft 365 Defender, cyber security, advanced persistent threat, enterprise security, devices, device, identity, users, data, applications, incidents, automated investigation and remediation, advanced hunting search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Microsoft 365 Defender Train Security Staff | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-defender-train-security-staff.md | Title: Train your security staff for Microsoft 365 Defender description: Get to the key training resources for quick ramp-up of your security staff. keywords: videos, self-help, self-study, ramp-up, instruction, courses, learning path, Microsoft Learn, course, courses, SecOps, security analyst search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Microsoft 365 Defender | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-defender.md | description: Microsoft 365 Defender is a coordinated threat protection solution keywords: introduction to MMicrosoft 365 Defender, cyber security, advanced persistent threat, enterprise security, devices, device, identity, users, data, applications, incidents, automated investigation and remediation, advanced hunting search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Microsoft 365 Security Center Defender Cloud Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-center-defender-cloud-apps.md | Title: Microsoft Defender for Cloud Apps in Microsoft 365 Defender (Preview) description: Learn about changes from the Microsoft Defender for Cloud Apps to Microsoft 365 Defender keywords: Getting started with Microsoft 365 Defender, Microsoft Defender for Cloud Apps++ ms.mktglfcycl: deploy ms.localizationpriority: medium f1.keywords: |
| security | Microsoft 365 Security Center Mde | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-center-mde.md | Title: Microsoft Defender for Endpoint in Microsoft 365 Defender description: Learn about changes from the Microsoft Defender Security Center to Microsoft 365 Defender keywords: Getting started with Microsoft 365 Defender, Microsoft Defender for Office 365, Microsoft Defender for Endpoint, MDO, MDE, security portal, defender security portal++ ms.mktglfcycl: deploy ms.localizationpriority: medium f1.keywords: |
| security | Microsoft 365 Security Center Mdi | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-center-mdi.md | Title: Microsoft Defender for Identity in Microsoft 365 Defender description: Learn about changes from the Microsoft Defender for Identity to Microsoft 365 Defender keywords: Getting started with Microsoft 365 Defender, Microsoft Defender for Identity, NDI++ ms.mktglfcycl: deploy ms.localizationpriority: medium f1.keywords: |
| security | Microsoft 365 Security Center Mdo | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-center-mdo.md | search.appverid: - M365-security-compliance ++ # Microsoft Defender for Office 365 in Microsoft 365 Defender |
| security | Microsoft 365 Security Mde Redirection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-mde-redirection.md | description: How to redirect accounts and sessions from the Defender for Endpoin keywords: Microsoft 365 Defender, Getting started with Microsoft 365 Defender, security center redirection search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Microsoft 365 Security Mdi Redirection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-mdi-redirection.md | description: How to redirect accounts and sessions from Defender for Identity to keywords: Microsoft 365 Defender, Getting started with Microsoft 365 Defender, security center redirection search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Microsoft Secure Score History Metrics Trends | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-secure-score-history-metrics-trends.md | Title: Track your Microsoft Secure Score history and meet goals description: Gain insights into activity that has affected your Microsoft Secure Score. Discover trends and set goals. keywords: microsoft secure score, secure score, office 365 secure score, microsoft security score, Microsoft 365 Defender portal, improvement actions++ ms.mktglfcycl: deploy ms.localizationpriority: medium f1.keywords: search.appverid: - seo-marvel-apr2020 - seo-marvel-jun2020 # Track your Microsoft Secure Score history and meet goals |
| security | Microsoft Secure Score Improvement Actions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-secure-score-improvement-actions.md | Title: Assess your security posture through Microsoft Secure Score description: Describes how to take action to improve your Microsoft Secure Score in the Microsoft 365 Defender portal. keywords: microsoft secure score, secure score, office 365 secure score, microsoft security score, Microsoft 365 Defender portal, improvement actions++ ms.mktglfcycl: deploy ms.localizationpriority: medium f1.keywords: search.appverid: - seo-marvel-apr2020 - seo-marvel-jun2020 # Assess your security posture with Microsoft Secure Score |
| security | Microsoft Secure Score Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-secure-score-whats-new.md | Title: What's new in Microsoft Secure Score description: Describes what new changes have happened to Microsoft Secure Score in the Microsoft 365 Defender portal. keywords: microsoft secure score, secure score, office 365 secure score, microsoft security score, Microsoft 365 Defender portal ms.mktglfcycl: deploy ms.localizationpriority: medium f1.keywords: - NOCSH++ search.appverid: - seo-marvel-apr2020 - seo-marvel-jun2020 # What's new in Microsoft Secure Score |
| security | Microsoft Secure Score | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-secure-score.md | Title: Microsoft Secure Score description: Describes Microsoft Secure Score in the Microsoft 365 Defender portal, how to improve your security posture, and what security admins can expect. keywords: microsoft secure score, secure score, office 365 secure score, microsoft security score, Microsoft 365 Defender portal, improvement actions++ ms.mktglfcycl: deploy ms.localizationpriority: medium f1.keywords: search.appverid: - seo-marvel-apr2020 - seo-marvel-jun2020 # Microsoft Secure Score |
| security | Microsoft Threat Experts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-threat-experts.md | description: Microsoft Threat Experts provides an extra layer of expertise to Mi keywords: managed threat hunting service, managed threat hunting, managed detection and response (MDR) service, MTE, Microsoft Threat Experts, endpoint attack notification, Endpoint Attack Notification search.product: Windows 10 search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro - M365-security-compliance - m365initiative-m365-defender |
| security | Mssp Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/mssp-access.md | Title: Provide managed security service provider (MSSP) access description: Learn about changes from the Microsoft Defender Security Center to the Microsoft 365 Defender portal keywords: Getting started with the Microsoft 365 Defender portal, Microsoft Defender for Office 365, Microsoft Defender for Endpoint, MDO, MDE, single pane of glass, converged portal, security portal, defender security portal++ ms.mktglfcycl: deploy ms.localizationpriority: medium f1.keywords: |
| security | Onboarding Defender Experts For Hunting | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/onboarding-defender-experts-for-hunting.md | |
| security | Playbook Detecting Ransomware M365 Defender | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/playbook-detecting-ransomware-m365-defender.md | |
| security | Playbook Responding Ransomware M365 Defender | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/playbook-responding-ransomware-m365-defender.md | |
| security | Portals | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/portals.md | Title: Microsoft security portals and admin centers description: Find the right Microsoft admin center or portal for managing various services related to Microsoft 365 security keywords: security, portals, Microsoft 365, M365, security center, admin center, URL, link, Microsoft 365 Defender, Microsoft Defender for Endpoint, Microsoft Defender Security Center, Microsoft Defender for Identity, Microsoft Defender for Office 365, MCAS, WDSI, SCC, Intune, MDM, MEM, ASC, Cloud App Security , Azure AD, security & compliance center++ ms.mktglfcycl: deploy ms.localizationpriority: medium f1.keywords: |
| security | Prerequisites | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/prerequisites.md | Title: Microsoft 365 Defender prerequisites description: Learn about the licensing, hardware and software requirements, and other configuration settings for Microsoft 365 Defender keywords: requirements, prerequisites, hardware, software, browser, Microsoft 365 Defender, M365, license, E5, A5, EMS, purchase search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Preview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/preview.md | Title: Preview features in Microsoft 365 Defender description: Learn about new features in Microsoft 365 security keywords: preview, new, m365 security, security, 365, capabilities search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Setup M365deval | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/setup-m365deval.md | description: Access Microsoft 365 Defender portal then set up your Microsoft 365 keywords: Microsoft 365 Defender trial setup, Microsoft 365 Defender pilot setup, try Microsoft 365 Defender, Microsoft 365 Defender evaluation lab setup search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security+ - highpri # Set up your Microsoft 365 Defender trial in a lab environment |
| security | Streaming Api Event Hub | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/streaming-api-event-hub.md | description: Learn how to configure Microsoft 365 Defender to stream Advanced Hu keywords: raw data export, streaming API, API, Azure Event Hubs, Azure storage, storage account, Advanced Hunting, raw data sharing search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro # Configure Microsoft 365 Defender to stream Advanced Hunting events to your Azure Event Hub |
| security | Streaming Api Storage | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/streaming-api-storage.md | description: Learn how to configure Microsoft 365 Defender to stream Advanced Hu keywords: raw data export, streaming API, API, Event Hubs, Azure storage, storage account, Advanced Hunting, raw data sharing search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro # Configure Microsoft 365 Defender to stream Advanced Hunting events to your Storage account |
| security | Streaming Api | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/streaming-api.md | description: Learn how to configure Microsoft 365 Defender to stream Advanced Hu keywords: raw data export, streaming API, API, Event hubs, Azure storage, storage account, Advanced Hunting, raw data sharing search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Supported Event Types | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/supported-event-types.md | description: Learn which streaming event types (tables) are supported by the str keywords: raw data export, Streaming API, API, Event hubs, Azure storage, storage account, Hunting, raw data sharing search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Threat Analytics Analyst Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/threat-analytics-analyst-reports.md | description: Learn about the analyst report section of each threat analytics rep keywords: analyst report, threat analytics, detections, advanced hunting queries, mitigations, search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Threat Analytics | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/threat-analytics.md | Title: Threat analytics in Microsoft 365 Defender description: Learn about emerging threats and attack techniques and how to stop them. Assess their impact to your organization and evaluate your organizational resilience. keywords: threat analytics, risk evaluation, Microsoft 365 Defender, M365D, mitigation status, secure configuration, Microsoft Defender for Office 365, Microsoft Defender for Office 365 threat analytics, MDO threat analytics, integrated MDE and MDO threat analytics data, threat analytics data integration, integrated Microsoft 365 Defender threat analytics ++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Tickets | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/tickets.md | Title: Integrate ServiceNow tickets into the Microsoft 365 Defender portal and compliance center description: Learn how to create and track tickets in ServiceNow from the Microsoft 365 Defender portal and compliance center. keywords: security, Microsoft 365, M365, compliance, compliance center, security center, ServiceNow, tickets, tasks, SNOW, connection++ ms.mktglfcycl: deploy ms.localizationpriority: medium f1.keywords: search.appverid: - MET150 - seo-marvel-apr2020 # Integrate ServiceNow tickets into the Microsoft 365 Defender portal and compliance center |
| security | Top Scoring Industry Tests | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/top-scoring-industry-tests.md | Title: Top scoring in industry tests - Microsoft 365 Defender description: View the latest scores and analysis of Microsoft 365 Defender. It consistently achieves high scores in independent tests (AV-TEST, AV Comparatives, SE Labs, MITRE ATT&CK). View the latest scores and analysis. keywords: Microsoft Defender Antivirus, Windows Defender Antivirus, av reviews, antivirus test, av testing, latest av scores, detection scores, security product testing, security industry tests, industry antivirus tests, best antivirus, av-test, av-comparatives, SE labs, MITRE ATT&CK, endpoint protection platform, EPP, endpoint detection and response, EDR, Windows 10, Windows 11 Microsoft Defender Antivirus, WDAV, Microsoft Defender for Endpoint, Microsoft 365 Defender, security, malware, av, antivirus, scores, scoring, next generation protection, ranking, success++ ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: high audience: ITPro search.appverid: met150 # Top scoring in industry tests |
| security | Troubleshoot | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/troubleshoot.md | Title: Troubleshoot Microsoft 365 Defender service issues description: Find solutions and workarounds to known Microsoft 365 Defender issues keywords: troubleshoot Microsoft 365 Defender, troubleshoot, Microsoft Defender for Identity, issues, add-on, settings page search.product: eADQiWindows 10XVcnh++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Usgov | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/usgov.md | description: Learn about the Microsoft 365 Defender for US Government customers keywords: government, gcc, high, requirements, capabilities, defender, Microsoft 365 Defender, xdr, dod search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security |
| security | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/whats-new.md | description: Lists the new features and functionality in Microsoft 365 Defender keywords: what's new in Microsoft 365 Defender, ga, generally available, capabilities, available, new search.product: eADQiWindows 10XVcnh search.appverid: met150++ ms.mktglfcycl: secure ms.sitesec: library ms.pagetype: security audience: ITPro - M365-security-compliance # What's new in Microsoft 365 Defender |
| security | Attack Simulation Training Login Pages | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-login-pages.md | |
| security | Attack Simulation Training Payload Automations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-payload-automations.md | |
| security | Attack Simulation Training Payloads | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-payloads.md | |
| security | Attack Simulation Training Simulation Automations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-simulation-automations.md | |
| security | Attack Simulation Training | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training.md | |
| security | Automated Investigation Response Office | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/automated-investigation-response-office.md | description: See how automated investigation and response capabilities work in M - air - seo-marvel-mar2020++ # How automated investigation and response works in Microsoft Defender for Office 365 |
| security | Azure Ip Protection Features | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/azure-ip-protection-features.md | |
| security | Backscatter Messages And Eop | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/backscatter-messages-and-eop.md | |
| security | Bulk Complaint Level Values | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/bulk-complaint-level-values.md | ms.assetid: a5b03b3c-37dd-429e-8e9b-2c1b25031794 - M365-security-compliance description: Admins can learn about bulk complaint level (BCL) values that are used in Exchange Online Protection (EOP).++ # Bulk complaint level (BCL) in EOP |
| security | Campaigns | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/campaigns.md | |
| security | Configuration Analyzer For Security Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies.md | |
| security | Configure Advanced Delivery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-advanced-delivery.md | |
| security | Configure Anti Malware Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-anti-malware-policies.md | |
| security | Configure Anti Phishing Policies Eop | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-anti-phishing-policies-eop.md | |
| security | Configure Global Settings For Safe Links | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-global-settings-for-safe-links.md | |
| security | Configure Junk Email Settings On Exo Mailboxes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-junk-email-settings-on-exo-mailboxes.md | search.appverid: - M365-security-compliance description: Admins can learn how to configure the junk email settings in Exchange Online mailboxes. Many of these settings are available to users in Outlook or Outlook on the web.++ # Configure junk email settings on Exchange Online mailboxes |
| security | Configure Mdo Anti Phishing Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-mdo-anti-phishing-policies.md | |
| security | Configure Review Priority Account | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-review-priority-account.md | |
| security | Configure The Connection Filter Policy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-the-connection-filter-policy.md | |
| security | Configure The Outbound Spam Policy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-the-outbound-spam-policy.md | |
| security | Configure Your Spam Filter Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-your-spam-filter-policies.md | |
| security | Create Block Sender Lists In Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/create-block-sender-lists-in-office-365.md | ms.localizationpriority: medium search.appverid: - MET150s description: Admins can learn about the available and preferred options to block inbound messages in Exchange Online Protection (EOP).++ # Create blocked sender lists in EOP |
| security | Create Safe Sender Lists In Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/create-safe-sender-lists-in-office-365.md | ms.assetid: 9721b46d-cbea-4121-be51-542395e6fd21 - seo-marvel-apr2020 description: Admins can learn about the available and preferred options to allow inbound messages in Exchange Online Protection (EOP).++ # Create safe sender lists in EOP |
| security | Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/defender-for-office-365.md | |
| security | Identity Access Policies Guest Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/identity-access-policies-guest-access.md | + - highpri ms.technology: mdo |
| security | Identity Access Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/identity-access-policies.md | + - highpri ms.technology: mdo |
| security | Identity Access Prerequisites | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/identity-access-prerequisites.md | + - highpri ms.technology: mdo |
| security | Microsoft 365 Continuous Access Evaluation | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/microsoft-365-continuous-access-evaluation.md | + - highpri ms.technology: mdo # Continuous access evaluation for Microsoft 365 |
| security | Microsoft 365 Policies Configurations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/microsoft-365-policies-configurations.md | + - highpri ms.technology: mdo # Zero Trust identity and device access configurations |
| security | Migrate To Defender For Office 365 Onboard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/migrate-to-defender-for-office-365-onboard.md | search.appverid: - M365-security-compliance - m365solution-mdo-migration+ - highpri description: "Complete the steps for migrating from a third-party protection service or device to Microsoft Defender for Office 365 protection." ms.technology: mdo |
| security | Migrate To Defender For Office 365 Prepare | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/migrate-to-defender-for-office-365-prepare.md | search.appverid: - M365-security-compliance - m365solution-mdo-migration+ - highpri description: "Prerequisite steps for migrating from a third-party protection service or device to Microsoft Defender for Office 365 protection." ms.technology: mdo |
| security | Migrate To Defender For Office 365 Setup | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/migrate-to-defender-for-office-365-setup.md | search.appverid: - M365-security-compliance - m365solution-mdo-migration+ - highpri description: "Take the steps to begin migrating from a third-party protection service or device to Microsoft Defender for Office 365 protection." ms.technology: mdo |
| security | Migrate To Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/migrate-to-defender-for-office-365.md | search.appverid: - M365-security-compliance - m365solution-mdo-migration+ - highpri description: Learn the right way to migrate from third-party protection services or devices like Google Postini, the Barracuda Spam and Virus Firewall, or Cisco IronPort to Microsoft Defender for Office 365 protection. ms.technology: mdo |
| security | Recover From Ransomware | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/recover-from-ransomware.md | + - highpri description: Microsoft 365 admins can learn how to recover from a ransomware attack. ms.technology: mdo ms.prod: m365-security |
| security | Responding To A Compromised Email Account | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account.md | + - highpri - TopSMBIssues - seo-marvel-apr2020 |
| security | Secure Email Recommended Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/secure-email-recommended-policies.md | + - highpri ms.technology: mdo |
| security | Security Recommendations For Priority Accounts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/security-recommendations-for-priority-accounts.md | + - highpri description: Admins can learn how to elevate the security settings and use reports, alerts, and investigations for priority accounts in their Microsoft 365 organizations. ms.technology: mdo |
| security | Sharepoint File Access Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/sharepoint-file-access-policies.md | + - highpri ms.technology: mdo |
| security | What S The Difference Between Junk Email And Bulk Email | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/what-s-the-difference-between-junk-email-and-bulk-email.md | Because of the mixed reaction to bulk email, there isn't universal guidance that Anti-spam polices have a default BCL threshold that's used to identify bulk email as spam. Admins can increase or decrease the threshold. For more information, see the following topics: - [Configure anti-spam policies in EOP](configure-your-spam-filter-policies.md).- - [EOP anti-spam policy settings](recommended-settings-for-eop-and-office365.md#eop-anti-spam-policy-settings) Another option that's easy to overlook: if a user complains about receiving bulk email, but the messages are from reputable senders that pass spam filtering in EOP, have the user check for a unsubscribe option in the bulk email message. ## How to tune bulk email -In Septemeber 2022, Microsoft Defender for Office 365 Plan 2 customers can access BCL from [advanced hunting](/microsoft-365/security/defender/advanced-hunting-overview). This feature allows admins to look at all bulk senders who sent mail to their organization, along with the corresponding BCL values and the email volume received. You can drill down into the bulk senders by using other columns in **EmailEvents** table in the **Email & collaboration** schema. For more information, see [EmailEvents](/microsoft-365/security/defender/advanced-hunting-emailevents-table). +In September 2022, Microsoft Defender for Office 365 Plan 2 customers can access BCL from [advanced hunting](/microsoft-365/security/defender/advanced-hunting-overview). This feature allows admins to look at all bulk senders who sent mail to their organization, along with the corresponding BCL values and the email volume received. You can drill down into the bulk senders by using other columns in **EmailEvents** table in the **Email & collaboration** schema. For more information, see [EmailEvents](/microsoft-365/security/defender/advanced-hunting-emailevents-table). For example, if Contoso has set their current bulk threshold to 7 in anti-spam policies, Contoso recipients will receive email from all senders with BCL \< 7 in their Inbox. Admins can run the following query to get a list of all bulk senders in the organization: EmailEvents This query allows admins to identify wanted and unwanted senders. If a bulk sender has a BCL score that doesn't meet the bulk threshold, admins can [submit the senderΓÇÖs messages to Microsoft for analysis](allow-block-email-spoof.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-domains-and-email-addresses-in-the-submissions-portal), which adds the sender as an allow entry to the Tenant Allow/Block List. -Organizations without Defender for Office 365 Plan 2 can use the [Threat protection status report](view-email-security-reports.md#threat-protection-status-report) to identify wanted and unwanted bulk senders: +Organizations without Defender for Office 365 Plan 2 can try the features in Microsoft 365 Defender for Office 365 Plan 2 for free. Use the 90-day Defender for Office 365 evaluation at <https://security.microsoft.com/atpEvaluation>. Learn about who can sign up and trial terms [here](try-microsoft-defender-for-office-365.md) or you can use the [Threat protection status report](view-email-security-reports.md#threat-protection-status-report) to identify wanted and unwanted bulk senders: ++1. In the Threat protection status report, select **View data by Email \> Spam**. To go directly to the report, open one of the following URLs: ++ - EOP: <https://security.microsoft.com/reports/TPSAggregateReport> + - Defender for Office 365: <https://security.microsoft.com/reports/TPSAggregateReportATP> -1. Go to Threat protection status report at <https://security.microsoft.com/reports/URLProtectionActionReport> and filter by **View data by Email** \> **Spam**. - 2. Filter for Bulk email, select an email to investigate and click on email entity to learn more about the sender. Email entity is available only for Defender for Office 365 Plan 2 customers. 3. Once you have identified wanted and unwanted senders, adjust the bulk threshold to your desired level. If there are bulk senders with BCL score that doesn't fit within your bulk threshold, [submit the messages to Microsoft for analysis](allow-block-email-spoof.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-domains-and-email-addresses-in-the-submissions-portal), which adds the sender as an allow entry to the Tenant Allow/Block List. -Admins can follow the recommeded bulk threshold values or choose a bulk threshold value that suits the needs of their organization. +Admins can follow the [recommended bulk threshold values](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365.md#anti-spam-anti-malware-and-anti-phishing-protection-in-eop) bulk threshold values or choose a bulk threshold value that suits the needs of their organization. |
| solutions | Financial Services Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/financial-services-overview.md | + + Title: Microsoft 365 solutions for the financial services industry +description: Learn about solution and architecture resources for the financial services industry using Microsoft 365 ++++ms.audience: ITPro ++ms.localizationpriority: medium ++- M365-subscription-management +- M365solutions ++f1.keywords: NOCSH +++# Microsoft 365 solutions for the financial services industry ++Microsoft provides many capabilities to help financial services organizations protect data, identities, devices, and applications. Microsoft also provides a comprehensive platform for the financial services industry, Microsoft Cloud for Financial Services, which includes components from Microsoft 365 and Dynamics 365, in addition to Azure. ++<br> ++> [!VIDEO https://www.youtube.com/embed/MqESP4OIC00] ++<br> ++Learn how you can use Microsoft 365, Dynamics 365, and Azure to digitize, modernize, and enhance your financial services solution. ++## Resources for financial services ++|Resource |Description | +||| +|[Key compliance and security considerations for US banking and capital markets](financial-services-secure-collaboration.md) | Learn how the Microsoft 365 platform helps financial services move to a modern collaboration platform, while helping keep data and systems secure and compliant with regulations. | +|[Microsoft 365 for Financial Services](/frontline/teams-for-financial-services) | Learn how your financial services organization can communicate within and across locations, simplify business processes, onboard and train employees, and strengthen corporate communications with Microsoft 365. | +|[Microsoft Cloud for Financial Services](/industry/financial-services/overview) | Learn about Microsoft Cloud for Financial Services and how it brings together trusted capabilities to customers and partners that improve customer and employee experiences and help protect accounts and purchases. | +| [Azure architecture and solutions for financial services](/azure/architecture/industries/finance)| Learn how you can use Microsoft Azure services to digitize, modernize, and enhance your financial services solution at Azure for financial services.| ++## Videos you can share with your team ++Learn about Microsoft Cloud for Financial ++<br> ++> [!VIDEO https://www.microsoft.com/videoplayer/embed/RWMlmS] + |
| solutions | Healthcare Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/healthcare-overview.md | Learn how you can use Microsoft 365, Dynamics 365, and Azure to digitize, modern |Resource |Description | ||| |[Virtual visits with Microsoft Teams and the Bookings app](/microsoftteams/expand-teams-across-your-org/bookings-virtual-visits) | The Bookings app in Microsoft Teams gives organizations a simple way to schedule and manage virtual appointments for staff and attendees. Use it to schedule virtual appointments such as healthcare visits, financial consultations, interviews, customer support, virtual shopping experiences, education office hours, and more. |-|[Teams for Healthcare ](/MicrosoftTeams/expand-teams-across-your-org/healthcare/teams-in-hc) | Microsoft Teams offers a number of telemedicine features useful for hospitals and other Healthcare organizations. <br>- Virtual visits and Electronic Healthcare Record (EHR) integration<br>- Teams policy packages<br>- Secure messaging<br>- Teams templates<br>- Care coordination and collaboration | +|[Microsoft 365 for Healthcare](/microsoft-365/frontline/teams-in-hc) | Microsoft Teams offers a number of telemedicine features useful for hospitals and other Healthcare organizations. <br>- Virtual visits and Electronic Healthcare Record (EHR) integration<br>- Teams policy packages<br>- Secure messaging<br>- Teams templates<br>- Care coordination and collaboration | |[Microsoft Cloud for Healthcare](/industry/healthcare/overview) | Learn about Microsoft Cloud for Healthcare and how it brings together trusted capabilities to customers and partners that enhance patient engagement, empowers health team collaboration, and improves clinical and operational data insights to improve decision-making and operational efficiencies. | | [Azure architecture and solutions for healthcare](/azure/architecture/industries/healthcare)| Learn how you can use Microsoft Azure services to digitize, modernize, and enhance your healthcare solution at Azure for healthcare|-| | | ## Videos you can share with your team |
| solutions | Retail Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/retail-overview.md | Learn how you can use Microsoft 365, Dynamics 365, and Azure to digitize, modern |Resource |Description | |||-|[Teams for Retail ](/microsoftteams/expand-teams-across-your-org/teams-for-retail-landing-page) | Microsoft 365 and Microsoft Teams offer several capabilities that can help retail organizations with their daily operations and digital transformation. <br>- In-store and cross-store communication <br>- Virtual fittings and consultations <br>- Simplify business processes <br>- Corporate communications <br>- Onboarding new employees | +|[Microsoft 365 for Retail](../frontline/teams-for-retail-landing-page.md) | Microsoft 365 and Microsoft Teams offer several capabilities that can help retail organizations with their daily operations and digital transformation. <br>- In-store and cross-store communication <br>- Virtual fittings and consultations <br>- Simplify business processes <br>- Corporate communications <br>- Onboarding new employees | |[Microsoft Cloud for Retail](/industry/retail/overview) | Learn about Microsoft Cloud for Retail and how it accelerates business growth by providing trusted retail industry solutions that integrate with retailerΓÇÖs existing systems. | |[Azure architecture and solutions for retail](/azure/architecture/industries/retail)| Learn how you can use Microsoft Azure services to digitize, modernize, and enhance your retail solutions at Azure Solutions for the Retail industry. |-| | | ## Videos you can share with your team |