Docs update tracker

Updates from: 08/31/2023 03:08:10

Category	Microsoft Docs article	Related commit history on GitHub	Change details
admin	Centralized Deployment Of Add Ins	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/centralized-deployment-of-add-ins.md	f1.keywords: Previously updated : 02/18/2020 Last updated : 08/30/2023 audience: Admin description: "Determine if your tenant and users meet the requirements, so that # Determine if Centralized Deployment of add-ins works for your organization -Centralized Deployment is the recommended and most feature-rich way for most customers to deploy Office Add-ins to users and groups within your organization. If you're an admin, use this guidance to determine if your organization and users meet the requirements so that you can use Centralized Deployment. +> [!NOTE] +> [Integrated Apps](test-and-deploy-microsoft-365-apps.md) is the recommended and most feature-rich way for most customers to centrally deploy Office add-ins to users and groups within your organization. +> +>If Integrated Apps is not available for you or you are a customer in one of the sovereign or government clouds (GCC, GCC-H, DoD, AirGap or Gallatin), use this article as guidance to determine if your organization and users meet the requirements to use Centralized Deployment. Centralized Deployment provides the following benefits: In order to deploy an add-in via Centralized Deployment, you need to be either a Using the Centralized Deployment Compatibility Checker, you can verify whether the users on your tenant are set up to use Centralized Deployment for Word, Excel, and PowerPoint. The Compatibility Checker is not required for Outlook support. Download and install the [compatibility checker](https://aka.ms/officeaddindeploymentorgcompatibilitychecker). +> [!NOTE] +> Compatibility checker is currently not supported in any of the sovereign or government clouds (GCC, GCC-H, DoD, AirGap, Gallatin). + #### Run the compatibility checker 1. Start an elevated PowerShell.exe window.
admin	Manage Addins In The Admin Center	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/manage-addins-in-the-admin-center.md	f1.keywords: Previously updated : 07/06/2020 Last updated : 08/30/2023 audience: Admin description: "Learn about using Centralized add-ins to deploy add-ins to users a # Manage add-ins in the Microsoft 365 admin center +> [!NOTE] +> [Integrated Apps](test-and-deploy-microsoft-365-apps.md) is the recommended and most feature-rich way for most customers to centrally deploy Office add-ins to users and groups within your organization. + Office Add-ins help you personalize your documents and streamline the way you access information on the web. See [Start using your Office Add-in](https://support.microsoft.com/office/82e665c4-6700-4b56-a3f3-ef5441996862). After a Global or Exchange admin deploys add-ins for users in an organization, they can turn add-ins off or on, edit, delete, and manage access to the add-ins.
admin	Manage Deployment Of Add Ins	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/manage-deployment-of-add-ins.md	Title: "Deploy add-ins in the admin center" f1.keywords: - NOCSH--++ Previously updated : 02/18/2020 Last updated : 08/30/2023 audience: Admin description: "Learn to deploy add-ins to users and groups in your organization b # Deploy add-ins in the Microsoft 365 admin center -Office Add-ins help you personalize your documents and streamline the way you access information on the web (see [Start using your Office Add-in](https://support.microsoft.com/office/82e665c4-6700-4b56-a3f3-ef5441996862)). As an admin, you can deploy Office Add-ins for the users in your organization by using the Centralized Deployment feature in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>. Centralized Deployment is the recommended and most feature-rich way for most admins to deploy add-ins to users and groups within an organization. +> [!NOTE] +> [Integrated Apps](test-and-deploy-microsoft-365-apps.md) is the recommended and most feature-rich way for most customers to centrally deploy Office add-ins to users and groups within your organization. + +Office Add-ins help you personalize your documents and streamline the way you access information on the web (see [Start using your Office Add-in](https://support.microsoft.com/office/82e665c4-6700-4b56-a3f3-ef5441996862)). As an admin, you can deploy Office Add-ins for the users in your organization by using the Centralized Deployment feature in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>. For more information on how to determine if your organization can support Centralized Deployment, see [Determine if Centralized Deployment of add-ins works for your organization](centralized-deployment-of-add-ins.md). Before you begin, see [Determine if Centralized Deployment of add-ins works for 1. In the admin center, go to the Settings \> Integrated apps \> Add-ins page. -2. Select Deploy Add-in at the top of the page, and then select Next. + > [!NOTE] + > You can also deploy add-ins in the admin center through [Integrated Apps](test-and-deploy-microsoft-365-apps.md). Integrated Apps is the recommended place for admins to deploy add-ins, and is available to Global Administrator, Azure Application Administrator and Exchange Administrator. + > + > If you still want to continue using Centralized Deployment for admin deployment of add-ins, navigate to Settings, then select Integrated Apps. On top of the Integrated Apps page, choose the Add-ins link. If Integrated Apps is not available for you, you should be able to navigate to Centralized Deployment from Settings, and then select Add-ins. - > [!NOTE] - > You can also deploy add-ins in the admin center through [Integrated Apps](test-and-deploy-microsoft-365-apps.md). Integrated Apps is visible to Global and Exchange administrators. If you don't see the above steps, go to the Centralized Deployment section by going to Settings > Integrated apps. On the top of the Integrated apps page, choose Add-ins. + :::image type="content" source="../../media/Deployaddin.png" alt-text="Deploy Add-in" lightbox="../../media/Deployaddin.png"::: + + > [!NOTE] + > You can also deploy add-ins in the admin center through [Integrated Apps](test-and-deploy-microsoft-365-apps.md). Integrated Apps is visible to Global and Exchange administrators. If you don't see the above steps, go to the Centralized Deployment section by going to Settings > Integrated apps. On the top of the Integrated apps page, choose Add-ins. + +2. Select Deploy Add-in at the top of the page, and then select Next. 3. Select an option and follow the instructions. + :::image type="content" source="../../media/chooseofficestore.png" alt-text="Deploy Add-in" lightbox="../../media/chooseofficestore.png"::: 4. If you selected the option to add an add-in from the Office Store, make your add-in selection. </br> - You can view available add-ins by categories: Suggested for you, Rating, or Name. Only free add-ins are available from the Office Store. Paid add-ins aren't supported currently. After you select an add-in, accept the terms and conditions to proceed. <br/> + You can view available add-ins by categories: Suggested for you, Rating, or Name. Only free add-ins are available from the Office Store. Paid add-ins aren't supported currently. After you select an add-in, accept the terms and conditions to proceed. <br/> + :::image type="content" source="../../media/addanaddin.png" alt-text="Deploy Add-in" lightbox="../../media/addanaddin.png"::: - > [!NOTE] - > With the Office Store option, updates and enhancements are automatically deployed to users. + > [!NOTE] + > With the Office Store option, updates and enhancements are automatically deployed to users. 5. On the next page, select Everyone, Specific users/groups, or Just me to specify who the add-in is deployed to. Use the Search box to find specific users or groups. <br/> + :::image type="content" source="../../media/selectusers.png" alt-text="Deploy Add-in" lightbox="../../media/selectusers.png"::: - > [!NOTE] - > To learn about other states that apply to an add-in, see [Add-in states](./manage-addins-in-the-admin-center.md). + > [!NOTE] + > To learn about other states that apply to an add-in, see [Add-in states](./manage-addins-in-the-admin-center.md). 6. Select Deploy. 7. A green tick appears when the add-in is deployed. Follow the on-page instructions to test the add-in. - > [!NOTE] - > Users might need to relaunch Microsoft 365 to view the add-in icon on the app ribbon. Outlook add-ins can take up to 24 hours to appear on app ribbons. + > [!NOTE] + > Users might need to relaunch Microsoft 365 to view the add-in icon on the app ribbon. Outlook add-ins can take up to 24 hours to appear on app ribbons. 8. When finished, select Next. If you've deployed to just yourself, you can select Change who has access to add-in to deploy to more users. - If you've deployed the add-in to other members of your organization, follow the instructions to announce the deployment of the add-in. <br/> + If you've deployed the add-in to other members of your organization, follow the instructions to announce the deployment of the add-in. <br/> - It's good practice to inform users and groups that the deployed add-in is available. Consider sending an email that describes when and how to use the add-in. Include or link to Help content or FAQs that might help users if they have problems with the add-in. + It's good practice to inform users and groups that the deployed add-in is available. Consider sending an email that describes when and how to use the add-in. Include or link to Help content or FAQs that might help users if they have problems with the add-in. ### Considerations when assigning an add-in to users and groups Updates for add-ins happen as follows: - Line-of-business add-in: In this case, where an admin explicitly uploaded a manifest, the add-in requires that the admin upload a new manifest file to support metadata changes. The next time the relevant Microsoft 365 apps start, the add-in will update. The web application can change at any time. - > [!NOTE] - > Admin does not need to remove a LOB Add-in for doing an update. In the Add-ins section, Admin can simply click on the LOB Add-in and choose the Update Button in the bottom right corner. Update will work only if the version of the new add-in is greater than that of the existing add-in. + > [!NOTE] + > Admin does not need to remove a LOB Add-in for doing an update. In the Add-ins section, Admin can simply click on the LOB Add-in and choose the Update Button in the bottom right corner. Update will work only if the version of the new add-in is greater than that of the existing add-in. - Office Store add-in: When an admin selected an add-in from the Office Store, if an add-in updates in the Office Store, the add-in will update later in Centralized Deployment. The next time the relevant Office applications start, the add-in will update. The web application can change at any time.
admin	Test And Deploy Microsoft 365 Apps	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/test-and-deploy-microsoft-365-apps.md	f1.keywords: Previously updated : 02/25/2020 Last updated : 08/30/2023 audience: Admin You can continue to manage access to Office add-ins and Teams apps via the follo - Exchange admin center for Outlook Add-ins - Teams admin center for Teams Apps -You can continue to deploy [Office Add-ins via Integrated Apps](/microsoft-365/admin/manage/test-and-deploy-microsoft-365-apps.md#deploy-an-office-add-in-using-the-admin-center) and [Teams Apps via Teams admin center](/microsoftteams/manage-apps). +You can continue to deploy [Deploy and manage Office Add-ins](/microsoft-365/admin/manage/office-addins) and [Teams Apps via Teams admin center](/microsoftteams/manage-apps). ## Frequently asked questions Only Global Admins, Azure Application Admins and Exchange admins can access Inte - Global admins can edit all controls for all apps and add-ins in Integrated Apps - Azure Application admins can edit controls for Teams apps that work on Outlook and the Microsoft 365 app and Office/Outlook add-ins-- Exchange Admins can edit any controls for Outlook add-ins. +- Exchange Admins can edit any controls for Outlook add-ins deployed by them. Integrated apps won't show up in the left nav for other administrators.
enterprise	Device Management Roadmap Microsoft 365	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/device-management-roadmap-microsoft-365.md	This is built into Microsoft 365 and helps you secure and manage your users' mob ## Choose between the two options -To help you better assess which device management option is best for you, see [Choose between Basic Mobility Security and Intune](/microsoft-365/admin/basic-mobility-security/choose-between-basic-mobility-and-security-and-intunee). +To help you better assess which device management option is best for you, see [Choose between Basic Mobility Security and Intune](/microsoft-365/admin/basic-mobility-security/choose-between-basic-mobility-and-security-and-intune). Based on your assessment, get started managing your devices with:
enterprise	Microsoft 365 U S Government Gcc High Endpoints	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/microsoft-365-u-s-government-gcc-high-endpoints.md	Title: "Office 365 U.S. Government GCC High endpoints" Previously updated : 07/31/2023 Last updated : 08/29/2023 audience: ITPro Office 365 requires connectivity to the Internet. The endpoints below should be \|Notes\|Download\| \|\|\| -\|Last updated: 07/31/2023 - ![RSS.](../media/5dc6bb29-25db-4f44-9580-77c735492c4b.png) [Change Log subscription](https://endpoints.office.com/version/USGOVGCCHigh?allversions=true&format=rss&clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7)\|Download: the full list in [JSON format](https://endpoints.office.com/endpoints/USGOVGCCHigh?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7)\| +\|Last updated: 08/29/2023 - ![RSS.](../media/5dc6bb29-25db-4f44-9580-77c735492c4b.png) [Change Log subscription](https://endpoints.office.com/version/USGOVGCCHigh?allversions=true&format=rss&clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7)\|Download: the full list in [JSON format](https://endpoints.office.com/endpoints/USGOVGCCHigh?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7)\| \| Start with [Managing Office 365 endpoints](managing-office-365-endpoints.md) to understand our recommendations for managing network connectivity using this data. Endpoints data is updated as needed at the beginning of each month with new IP Addresses and URLs published 30 days in advance of being active. This lets customers who don't yet have automated updates to complete their processes before new connectivity is required. Endpoints may also be updated during the month if needed to address support escalations, security incidents, or other immediate operational requirements. The data shown on this page below is all generated from the REST-based web services. If you're using a script or a network device to access this data, you should go to the [Web service](microsoft-365-ip-web-service.md) directly.
enterprise	Setup Overview For Enterprises	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/setup-overview-for-enterprises.md	To deploy Microsoft 365 Enterprise on your own after completing your planning, t 1. [Set up your network](set-up-network-for-microsoft-365.md) Includes adding your Internet domains and optimizing the network performance for your on-premises users. - + 2. [Set up your identities](protect-your-global-administrator-accounts.md) Includes determining an identity model (cloud-only or hybrid), and for hybrid identity, setting up directory synchronization between your on-premises Active Directory Domain Services (AD DS) and your Microsoft 365 subscription. -3. [Implement security](/microsoft-365/security/office-365-security/defender-for-office-36) +3. [Implement security](/microsoft-365/security/office-365-security/defender-for-office-365-whats-new) Includes configuring and rolling out basic and enhanced security, threat, and information protections for your tenant and identities in the first 30 days, 90 days, and beyond.
enterprise	Urls And Ip Address Ranges 21Vianet	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/urls-and-ip-address-ranges-21vianet.md	Title: "URLs and IP address ranges for Office 365 operated by 21Vianet" Previously updated : 08/10/2023 Last updated : 08/29/2023 audience: ITPro hideEdit: true Office 365 endpoints: [Worldwide (including GCC)](urls-and-ip-address-ranges.md) \| Office 365 operated by 21 Vianet \| [Office 365 U.S. Government DoD](microsoft-365-u-s-government-dod-endpoints.md) \| [Office 365 U.S. Government GCC High](microsoft-365-u-s-government-gcc-high-endpoints.md) \| -Last updated: 07/31/2023 - ![RSS.](../media/5dc6bb29-25db-4f44-9580-77c735492c4b.png) [Change Log subscription](https://endpoints.office.com/version/China?allversions=true&format=rss&clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7) +Last updated: 08/29/2023 - ![RSS.](../media/5dc6bb29-25db-4f44-9580-77c735492c4b.png) [Change Log subscription](https://endpoints.office.com/version/China?allversions=true&format=rss&clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7) Download: all required and optional destinations in one [JSON formatted](https://endpoints.office.com/endpoints/China?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7) list.
enterprise	Urls And Ip Address Ranges	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/urls-and-ip-address-ranges.md	Title: "Office 365 URLs and IP address ranges" Previously updated : 07/31/2023 Last updated : 08/29/2023 audience: Admin Office 365 requires connectivity to the Internet. The endpoints below should be \|Notes\|Download\|Use\| \|\|\|\| -\|Last updated: 07/31/2023 - ![RSS.](../medi#pacfiles)\| +\|Last updated: 08/29/2023 - ![RSS.](../medi#pacfiles)\| \| Start with [Managing Office 365 endpoints](managing-office-365-endpoints.md) to understand our recommendations for managing network connectivity using this data. Endpoints data is updated as needed at the beginning of each month with new IP Addresses and URLs published 30 days in advance of being active. This cadence allows for customers who don't yet have automated updates to complete their processes before new connectivity is required. Endpoints may also be updated during the month if needed to address support escalations, security incidents, or other immediate operational requirements. The data shown on this page below is all generated from the REST-based web services. If you're using a script or a network device to access this data, you should go to the [Web service](microsoft-365-ip-web-service.md) directly.
includes	Office 365 Operated By 21Vianet Endpoints	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/office-365-operated-by-21vianet-endpoints.md	<!--THIS FILE IS AUTOMATICALLY GENERATED. MANUAL CHANGES WILL BE OVERWRITTEN.--> <!--Please contact the Office 365 Endpoints team with any questions.--> -<!--China endpoints version 2023073100--> -<!--File generated 2023-08-09 16:41:39.6547--> +<!--China endpoints version 2023082900--> +<!--File generated 2023-08-30 08:00:16.5825--> ## Exchange Online ID \| Category \| ER \| Addresses \| Ports ## Microsoft 365 Common and Office Online ID \| Category \| ER \| Addresses \| Ports \| - \| -- \| -- \| - +-- \| \| -- \| -- \| - 7 \| Allow<BR>Required \| No \| `.azure-mobile.cn, .chinacloudapi.cn, .chinacloudapp.cn, .chinacloud-mobile.cn, .chinacloudsites.cn, .partner.microsoftonline-m.net.cn, .partner.microsoftonline-m-i.net.cn, .partner.microsoftonline-p.net.cn, .partner.officewebapps.cn, .windowsazure.cn, portal.partner.microsoftonline.cdnsvc.com, r4.partner.outlook.cn`<BR>`23.236.126.0/24, 40.73.240.0/24, 40.73.242.0/24, 58.68.168.0/24, 112.25.33.0/24, 123.150.49.0/24, 125.65.247.0/24, 171.107.84.0/24, 180.210.232.0/24, 180.210.234.0/24, 209.177.86.0/24, 209.177.90.0/24, 209.177.94.0/24, 222.161.226.0/24, 2406:e500:4900::/48` \| TCP: 443, 80 -8 \| Allow<BR>Required \| No \| `.onmschina.cn, .partner.microsoftonline.net.cn, .partner.microsoftonline-i.net.cn, .partner.office365.cn`<BR>`101.28.252.0/24, 115.231.150.0/24, 123.235.32.0/24, 171.111.154.0/24, 175.6.10.0/24, 180.210.229.0/24, 211.90.28.0/24` \| TCP: 443, 80 +8 \| Allow<BR>Required \| No \| `.onmschina.cn, .partner.microsoftonline.net.cn, .partner.microsoftonline-i.net.cn`<BR>`101.28.252.0/24, 115.231.150.0/24, 123.235.32.0/24, 171.111.154.0/24, 175.6.10.0/24, 180.210.229.0/24, 211.90.28.0/24` \| TCP:* 443, 80 9 \| Allow<BR>Required \| No \| `.partner.microsoftonline-p.cn`<BR>`182.50.87.0/24` \| TCP:* 443, 80 10 \| Allow<BR>Required \| No \| `.partner.microsoftonline.cn`<BR>`103.9.8.0/22` \| TCP:* 443, 80 11 \| Default<BR>Required \| No \| `activation.sls.microsoft.com, crl.microsoft.com, odc.officeapps.live.com, officecdn.microsoft.com, officeclient.microsoft.com` \| TCP: 443, 80 ID \| Category \| ER \| Addresses \| Ports 16 \| Default<BR>Required \| No \| `.cdn.office.net, shellprod.msocdn.com` \| TCP:* 443 17 \| Allow<BR>Required \| No \| `.auth.microsoft.cn, login.partner.microsoftonline.cn, microsoftgraph.chinacloudapi.cn`<BR>`40.72.70.0/23, 52.130.2.32/27, 52.130.3.64/27, 52.130.17.192/27, 52.130.18.32/27, 2406:e500:5500::/48` \| TCP:* 443, 80 18 \| Default<BR>Required \| No \| `.aadrm.cn, .protection.partner.outlook.cn` \| +22 \| Default<BR>Required \| No \| `.partner.office365.cn` \| TCP:* 443, 80 +23 \| Default<BR>Optional<BR>Notes: allow new microsoft365 home page \| No \| `microsoft365.microsoftonline.cn` \| TCP: 443, 80
includes	Office 365 U.S. Government Gcc High Endpoints	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/office-365-u.s.-government-gcc-high-endpoints.md	<!--THIS FILE IS AUTOMATICALLY GENERATED. MANUAL CHANGES WILL BE OVERWRITTEN.--> <!--Please contact the Office 365 Endpoints team with any questions.--> -<!--USGovGCCHigh endpoints version 2023073100--> -<!--File generated 2023-07-31 08:00:05.9608--> +<!--USGovGCCHigh endpoints version 2023082900--> +<!--File generated 2023-08-30 08:00:15.0134--> ## Exchange Online ID \| Category \| ER \| Addresses \| Ports ID \| Category \| ER \| Addresses \| Ports -- \| - \| \| -- \| - 11 \| Allow<BR>Required \| Yes \| `.gov.online.office365.us`<BR>`52.127.37.0/24, 52.127.82.0/23, 2001:489a:2208::/49` \| TCP:* 443 -12 \| Default<BR>Required \| Yes \| `.cdn.office365.us` \| TCP:* 443 13 \| Allow<BR>Required \| Yes \| `.auth.microsoft.us, .gov.us.microsoftonline.com, graph.microsoft.us, graph.microsoftazure.us, login.microsoftonline.us`<BR>`20.140.232.0/23, 52.126.194.0/23, 2001:489a:3500::/50` \| TCP: 443 14 \| Default<BR>Required \| No \| `.msauth.net, .msauthimages.us, .msftauth.net, .msftauthimages.us, clientconfig.microsoftonline-p.net, graph.windows.net, login.microsoftonline.com, login.microsoftonline-p.com, login.windows.net, loginex.microsoftonline.com, login-us.microsoftonline.com, mscrl.microsoft.com, nexus.microsoftonline-p.com, secure.aadcdn.microsoftonline-p.com` \| TCP: 443 15 \| Default<BR>Required \| No \| `officehome.msocdn.us, prod.msocdn.us` \| TCP: 443, 80
includes	Office 365 Worldwide Endpoints	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/office-365-worldwide-endpoints.md	<!--THIS FILE IS AUTOMATICALLY GENERATED. MANUAL CHANGES WILL BE OVERWRITTEN.--> <!--Please contact the Office 365 Endpoints team with any questions.--> -<!--Worldwide endpoints version 2023073100--> -<!--File generated 2023-07-31 08:00:03.0494--> +<!--Worldwide endpoints version 2023082900--> +<!--File generated 2023-08-30 08:00:13.1514--> ## Exchange Online ID \| Category \| ER \| Addresses \| Ports ID \| Category \| ER \| Addresses \| Ports \| - \| \| - \| - -11 \| Optimize<BR>Required \| Yes \| `13.107.64.0/18, 52.112.0.0/14, 52.122.0.0/15, 2603:1063::/39` \| UDP: 3478, 3479, 3480, 3481 -12 \| Allow<BR>Required \| Yes \| `.lync.com, .teams.microsoft.com, teams.microsoft.com`<BR>`13.107.64.0/18, 52.112.0.0/14, 52.122.0.0/15, 52.238.119.141/32, 52.244.160.207/32, 2603:1027::/48, 2603:1037::/48, 2603:1047::/48, 2603:1057::/48, 2603:1063::/39, 2620:1ec:6::/48, 2620:1ec:40::/42` \| TCP: 443, 80 -13 \| Allow<BR>Required \| Yes \| `.broadcast.skype.com, broadcast.skype.com`<BR>`13.107.64.0/18, 52.112.0.0/14, 52.122.0.0/15, 52.238.119.141/32, 52.244.160.207/32, 2603:1027::/48, 2603:1037::/48, 2603:1047::/48, 2603:1057::/48, 2603:1063::/39, 2620:1ec:6::/48, 2620:1ec:40::/42` \| TCP:* 443 +11 \| Optimize<BR>Required \| Yes \| `13.107.64.0/18, 52.112.0.0/14, 52.122.0.0/15, 2603:1063::/38` \| UDP: 3478, 3479, 3480, 3481 +12 \| Allow<BR>Required \| Yes \| `.lync.com, .teams.microsoft.com, teams.microsoft.com`<BR>`13.107.64.0/18, 52.112.0.0/14, 52.122.0.0/15, 52.238.119.141/32, 52.244.160.207/32, 2603:1027::/48, 2603:1037::/48, 2603:1047::/48, 2603:1057::/48, 2603:1063::/38, 2620:1ec:6::/48, 2620:1ec:40::/42` \| TCP: 443, 80 +13 \| Allow<BR>Required \| Yes \| `.broadcast.skype.com, broadcast.skype.com`<BR>`13.107.64.0/18, 52.112.0.0/14, 52.122.0.0/15, 52.238.119.141/32, 52.244.160.207/32, 2603:1027::/48, 2603:1037::/48, 2603:1047::/48, 2603:1057::/48, 2603:1063::/38, 2620:1ec:6::/48, 2620:1ec:40::/42` \| TCP:* 443 15 \| Default<BR>Required \| No \| `.sfbassets.com` \| TCP:* 443, 80 16 \| Default<BR>Required \| No \| `.keydelivery.mediaservices.windows.net, .streaming.mediaservices.windows.net, mlccdn.blob.core.windows.net` \| TCP: 443 17 \| Default<BR>Required \| No \| `aka.ms` \| TCP: 443 18 \| Default<BR>Optional<BR>Notes: Federation with Skype and public IM connectivity: Contact picture retrieval \| No \| `.users.storage.live.com` \| TCP:* 443 19 \| Default<BR>Optional<BR>Notes: Applies only to those who deploy the Conference Room Systems \| No \| `adl.windows.com` \| TCP: 443, 80 -22 \| Allow<BR>Optional<BR>Notes: Teams: Messaging interop with Skype for Business \| Yes \| `.skypeforbusiness.com`<BR>`13.107.64.0/18, 52.112.0.0/14, 52.122.0.0/15, 52.238.119.141/32, 52.244.160.207/32, 2603:1027::/48, 2603:1037::/48, 2603:1047::/48, 2603:1057::/48, 2603:1063::/39, 2620:1ec:6::/48, 2620:1ec:40::/42` \| TCP:* 443 +22 \| Allow<BR>Optional<BR>Notes: Teams: Messaging interop with Skype for Business \| Yes \| `.skypeforbusiness.com`<BR>`13.107.64.0/18, 52.112.0.0/14, 52.122.0.0/15, 52.238.119.141/32, 52.244.160.207/32, 2603:1027::/48, 2603:1037::/48, 2603:1047::/48, 2603:1057::/48, 2603:1063::/38, 2620:1ec:6::/48, 2620:1ec:40::/42` \| TCP:* 443 27 \| Default<BR>Required \| No \| `.mstea.ms, .secure.skypeassets.com, mlccdnprod.azureedge.net` \| TCP: 443 127 \| Default<BR>Required \| No \| `.skype.com` \| TCP:* 443, 80 167 \| Default<BR>Required \| No \| `.ecdn.microsoft.com` \| TCP:* 443 ID \| Category \| ER \| Addresses \| Ports 69 \| Default<BR>Required \| No \| `.aria.microsoft.com, .events.data.microsoft.com` \| TCP: 443 70 \| Default<BR>Required \| No \| `.o365weve.com, amp.azure.net, appsforoffice.microsoft.com, assets.onestore.ms, auth.gfx.ms, c1.microsoft.com, dgps.support.microsoft.com, docs.microsoft.com, msdn.microsoft.com, platform.linkedin.com, prod.msocdn.com, shellprod.msocdn.com, support.microsoft.com, technet.microsoft.com` \| TCP:* 443 71 \| Default<BR>Required \| No \| `.office365.com` \| TCP:* 443, 80 -72 \| Default<BR>Optional<BR>Notes: Azure Rights Management (RMS) with Office 2010 clients \| No \| `.cloudapp.net` \| TCP:* 443 73 \| Default<BR>Required \| No \| `.aadrm.com, .azurerms.com, .informationprotection.azure.com, ecn.dev.virtualearth.net, informationprotection.hosting.portal.azure.net` \| TCP:* 443 75 \| Default<BR>Optional<BR>Notes: Graph.windows.net, Office 365 Management Pack for Operations Manager, SecureScore, Azure AD Device Registration, Forms, StaffHub, Application Insights, captcha services \| No \| `.sharepointonline.com, dc.services.visualstudio.com, mem.gfx.ms, staffhub.ms` \| TCP:* 443 78 \| Default<BR>Optional<BR>Notes: Some Office 365 features require endpoints within these domains (including CDNs). Many specific FQDNs within these wildcards have been published recently as we work to either remove or better explain our guidance relating to these wildcards. \| No \| `.azureedge.net, .microsoft.com, .msocdn.com, .onmicrosoft.com` \| TCP: 443, 80
security	Device Control Removable Storage Access Control Faq	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control-faq.md	If the policy still isn't working, contact support, and share your support cab. ## Why is there no configuration UX for some policy groups? -There is no configuration UX for Define device control policy groups and Define device control policy rules on your Group Policy. But, you can still get the related `.adml` and `.admx` files by selecting Raw and Save as at the [WindowsDefender.adml](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/WindowsDefender.adml) and [WindowsDefender.admx](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/WindowsDefender.admx) files. +There is no configuration UX for Define device control policy groups and Define device control policy rules on your Group Policy. But, you can still get the related `.adml` and `.admx` files by selecting Raw and Save as at the [WindowsDefender.adml](https://github.com/microsoft/mdatp-devicecontrol/blob/main/WindowsDefender.adml) and [WindowsDefender.admx](https://github.com/microsoft/mdatp-devicecontrol/blob/main/WindowsDefender.admx) files. ## How do I confirm that the latest policy has been deployed to the target machine?
security	Enable Attack Surface Reduction	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction.md	Each ASR rule contains one of four settings: We recommend using ASR rules with a Windows E5 license (or similar licensing SKU) to take advantage of the advanced monitoring and reporting capabilities available in [Microsoft Defender for Endpoint](microsoft-defender-endpoint.md) (Defender for Endpoint). However, if you have another license, such as Windows Professional or Windows E3 that doesn't include advanced monitoring and reporting capabilities, you can develop your own monitoring and reporting tools on top of the events that are generated at each endpoint when ASR rules are triggered (for example, Event Forwarding). > [!TIP] -> To learn more about Windows licensing, see [Windows 10 Licensing](https://www.microsoft.com/licensing/product-licensing/windows10?activetab=windows10-pivot:primaryr5) and get the [Volume Licensing guide for Windows 10](https://download.microsoft.com/download/2/D/1/2D14FE17-66C2-4D4C-AF73-E122930B60F6/Windows-10-Volume-Licensing-Guide.pdf). +> To learn more about Windows licensing, see [Windows 10 Licensing](https://www.microsoft.com/licensing/product-licensing/windows10?activetab=windows10-pivot:primaryr5) and get the [Volume Licensing guide for Windows 10](https://www.microsoft.com/en-us/download/details.aspx?id=11091). You can enable attack surface reduction rules by using any of these methods:
security	Linux Exclusions	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-exclusions.md	Exclusions can be useful to avoid incorrect detections on files or software that ## Supported exclusion types -The follow table shows the exclusion types supported by Defender for Endpoint on Linux. +The following table shows the exclusion types supported by Defender for Endpoint on Linux. Exclusion\|Definition\|Examples \|\| In the following Bash snippet, replace `test.txt` with a file that conforms to y curl -o test.txt https://www.eicar.org/download/eicar.com.txt ``` -If Defender for Endpoint on Linux reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm that the contents are the same as what is described on the [EICAR test file website](http://2016.eicar.org/86-0-Intended-use.html). +If Defender for Endpoint on Linux reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm that the contents are the same as what is described on the [EICAR test file website](https://www.eicar.org/download-anti-malware-testfile/). If you do not have Internet access, you can create your own EICAR test file. Write the EICAR string to a new text file with the following Bash command:
security	Mac Device Control Overview	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-device-control-overview.md	Example 1: JAMF using [schema.json](https://github.com/microsoft/mdatp-xplat/tre :::image type="content" source="images/macos-device-control-jamf-json.png" alt-text="Shows how to enable Device Control in Microsoft Defender for Endpoint Data Loss Prevention / Features." lightbox="images/macos-device-control-jamf-json.png"::: -Example 2: [demo.mobileconfig](https://github.com/microsoft/mdatp-devicecontrol/tree/main/Removable%20Storage%20Access%20Control%20Samples/macos/mobileconfig) +Example 2: [demo.mobileconfig](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/macOS/mobileconfig/demo.mobileconfig) -```json +```xml <key>dlp</key> <dict> <key>features</key>
security	Mac Exclusions	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-exclusions.md	In the following Bash snippet, replace `test.txt` with a file that conforms to y curl -o test.txt https://www.eicar.org/download/eicar.com.txt ``` -If Defender for Endpoint on Mac reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm that the contents are the same as what is described on the [EICAR test file website](http://2016.eicar.org/86-0-Intended-use.html). +If Defender for Endpoint on Mac reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm that the contents are the same as what is described on the [EICAR test file website](https://www.eicar.org/download-anti-malware-testfile/). If you do not have Internet access, you can create your own EICAR test file. Write the EICAR string to a new text file with the following Bash command:
security	Mac Support Sys Ext	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-support-sys-ext.md	+ + Title: Troubleshoot system extension issues for Microsoft Defender for Endpoint on macOS +description: Troubleshoot system extension issues in Microsoft Defender for Endpoint on macOS. +keywords: microsoft, defender, Microsoft Defender for Endpoint, mac, performance, big sur, monterey, ventura, mde for mac + +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ++ +ms.localizationpriority: medium + +audience: ITPro + +- m365-security +- tier3 ++ +search.appverid: met150 Last updated : 06/07/2023++ +# Troubleshoot system extension issues in Microsoft Defender for Endpoint on macOS +++ +Applies to: + +- [Microsoft Defender for Endpoint on macOS](microsoft-defender-endpoint-mac.md) +- [Microsoft Defender for Endpoint Plan 1](defender-endpoint-plan-1-2.md) +- [Microsoft Defender for Endpoint Plan 2](defender-endpoint-plan-1-2.md) +- [Microsoft 365 Defender](../defender/microsoft-365-defender.md) + +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/get-started/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https%3a%2f%2faka.ms%2fMDEp2OpenTrial%3focid%3ddocs-wdatp-exposedapis-abovefoldlink&brandingId=28b276fb-d2a0-4379-a7c0-57dce33da0f9&ali=1&bac=1&signedinuser=v-smandalika%40microsoft.com) + +You can submit feedback by opening Microsoft Defender for Endpoint on Mac on your device and by navigating to Help > Send feedback. + +Another option is to submit feedback viaΓÇ»the Microsoft 365 Defender by launching security.microsoft.com and selecting the Give feedback tab. + +This article provides information on how to troubleshoot issues with the system extension that's installed as part of Microsoft Defender for Endpoint (MDE) on macOS. + +Starting with macOS BigSur (11), AppleΓÇÖs macOS requires all system extensions to be explicitly approved before they're allowed to run on the device. + +## Symptom + +You'll notice that the Microsoft Defender for Endpoint has an x symbol in the shield, as shown in the following screenshot: ++ +If you click the shield with the x symbol, you'll get options as shown in the following screenshot: ++ +Click Action needed. + +The screen as shown in the following screenshot appears: ++ +You can also run mdatp health: It reports if real-time protection is enabled but not available. This report indicates that the system extension isn't approved to run on your device. + +```bash +mdatp health +``` +The output on running mdatp health is: + +```Output +healthy : false +health_issues : [ΓÇ£no active event providerΓÇ¥, ΓÇ£network event provider not runningΓÇ¥, ΓÇ£full disk access has not been grantedΓÇ¥] +... +real_time_protection_enabled : unavailable +real_time_protection_available: unavailable +... +full_disk_access_enabled : false +``` +The output report displayed on running mdatp health is shown in the following screenshot: ++ +## Cause + +macOS requires that a user manually and explicitly approves certain functions that an application uses, for example, system extensions, running in background, sending notifications, full disk access, and so on. Microsoft Defender for Endpoint relies on these applications and can't properly function until all these consents are received from a user. + +If you didn't approve the system extension during the deployment/installation of Microsoft Defender for Endpoint on macOS, perform the following steps: + +1. Check the system extensions by running the following command in the terminal: + + ```BashCopy + systemextensionsctl list + ``` + + :::image type="content" source="images/check-system-extension.png" alt-text="The screen that shows what should be done to check the system extension." lightbox="images/check-system-extension.png"::: + +You'll notice that both Microsoft Defender for Endpoint on macOS extensions are in the [activated waiting for user] state. + +2. In the terminal, run the following command: + + ```BashCopy + mdatp health --details system_extensions + ``` + +You'll get the following output: + +```OutputCopy +network_extension_enabled : false +network_extension_installed : true +endpoint_security_extension_ready : false +endpoint_security_extension_installed : true +``` + +This output is shown in the following screenshot: ++ +The following files might be missing if you're managing it via Intune, JamF, or another MDM solution: + +\|MobileConfig (Plist) \|ΓÇ£mdatp healthΓÇ¥ console command output \|macOS setting needed for MDE on macOS to function properly \| +\|\|\|\| +\|"/Library/Managed Preferences/com.apple.system-extension-policy.plist" \| real_time_protection_subsystem \| System extension \| +\|"/Library/Managed Preferences/com.apple.webcontent-filter.plist" \| network_events_subsystem \| Network Filter extension \| +\|"/Library/Managed Preferences/com.apple.TCC.configuration-profile-policy.plist" \| full_disk_access_enabled \| Privacy Preference Policy Controls (PPPC, aka TCC (Transparency, Consent & Control), Full Disk Access (FDA)) \| +\|"/Library/Managed Preferences/com.apple.notificationsettings.plist" \| n/a \| End-user notifications \| +\|"/Library/Managed Preferences/servicemanagement.plistΓÇ¥ \| n/a \| Background services \| +\|"/Library/Managed Preferences/com.apple.TCC.configuration-profile-policy.plist" \| full_disk_access_enabled (for DLP) \| Accessibility \| + +To troubleshoot the issue of missing files to make Microsoft Defender for Endpoint on macOS work properly, see [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md#microsoft-defender-for-endpoint-on-mac). + +## Solution + +This section describes the solution of approving the functions such system extension, background services, notifications, full disk access, and so on using the management tools, namely Intune, JamF, Other MDM, and using the method of manual deployment. To perform these functions using these management tools, see: + +- [Intune](manage-profiles-approve-sys-extensions-intune.md#manage-profiles-and-approve-extensions-using-intune) +- [JamF](manage-sys-extensions-using-jamf.md#manage-system-extensions-using-jamf) +- [Other MDM](manage-sys-extensions-other-mdm.md#manage-system-extensions-using-other-mdm-solutions) +- [Manual deployment](manage-sys-extensions-manual-deployment.md#manage-system-extensions-using-the-manual-methods-of-deployment) + +### Prerequisites + +Prior to approving the system extension (using any of the specified management tools), ensure that the following prerequisites are fulfilled: + +#### Step 1: Are the profiles coming down to your macOS? + +If you're using Intune, see [Manage macOS software update policies in Intune](/mem/intune/protect/software-updates-macos). ++ +1. Click the ellipses (three dots). +1. Select Refresh devices. The screen as shown in the following screenshot appears: + + :::image type="content" source="images/screen-on-clicking-refresh-devices.png" alt-text="The screen that appears on clicking Refresh devices." lightbox="images/screen-on-clicking-refresh-devices.png"::: + +1. In Launchpad, type System Preferences. +1. Double-click Profiles. + + > [!NOTE] + > If you aren't MDM joined, you won't see Profiles as an option. Contact your MDM support team to see why the Profiles option isn't visible. You should be able to see the different profiles such as System Extensions, Accessibility, Background Services, Notifications, Microsoft AutoUpdate, and so on, as shown in the preceding screenshot. + +If you're using JamF, use sudo jamf policy. For more information, see [Policy Management](https://docs.jamf.com/10.26.0/jamf-pro/administrator-guide/Policy_Management.html#:~:text=To%20manually%20trigger%20the%20policy%20using%20the%20jamf,pre-defined%20trigger%2C%20replace%20%3CtriggerName%3E%20with%20the%20appropriate%20value.). + +#### Step 2: Ensure that the profiles needed for Microsoft Defender for Endpoint are enabled + +The section [Sections that provide guidance on enabling profiles needed for Microsoft Defender for Endpoint](#sections-that-provide-guidance-on-enabling-profiles-needed-for-microsoft-defender-for-endpoint) provides guidance on how to address this issue, depending on the method that you used to deploy Microsoft Defender for Endpoint on macOS. + +> [!NOTE] +> A proper naming convention for your configuration profiles is a real advantage. We recommend the following naming scheme: +> `Name of the Setting(s) [(additional info)] -Platform - Set - Policy-Type` +> For example, `FullDiskAccess (piloting) - macOS - Default - MDE` + +Using the recommended naming convention enables you to confirm that the correct profiles are dropping down at the time of checking. + +> [!TIP] +> To ensure that the correct profiles are coming down, instead of typing .mobileconfig (plist), you can download this profile from Github, to avoid typos elongated hyphens. + +In terminal, enter the following syntax: + +`curl -O https://URL` + +For example, + +```BashCopy + curl -O https://raw.githubusercontent.com/microsoft/mdatp-xplat/master/macos/mobileconfig/profiles/sysext.mobileconfig +``` + +##### Sections that provide guidance on enabling profiles needed for Microsoft Defender for Endpoint + +1. + - Function: [Approve System Extensions](mac-install-with-intune.md) + - Mobile config (plist): https://github.com/microsoft/mdatp-xplat/blob/master/macos/mobileconfig/profiles/sysext.mobileconfig + - Applicable to: + - Intune: Yes + - JamF: Yes + - Other MDM: Yes + - Manual: Must approve the extension by going to Security Preferences or System Preferences > Security & Privacy and then selecting Allow. + +2. + - Function: [Network Filter](mac-install-with-intune.md) + - Mobile config (plist): https://github.com/microsoft/mdatp-xplat/blob/master/macos/mobileconfig/profiles/netfilter.mobileconfig + - Applicable to: + - Intune: Yes + - JamF: Yes + - Other MDM: Yes + - Manual: Must approve the extension by going to Security Preferences or System Preferences > Security & Privacy and then selecting Allow. + +3. + - Function: [Privacy Preference Policy Controls (PPPC, aka TCC (Transparency, Consent & Control), Full Disk Access (FDA))](mac-install-with-intune.md) + - Mobile config (plist): https://github.com/microsoft/mdatp-xplat/blob/master/macos/mobileconfig/profiles/fulldisk.mobileconfig + - Applicable to: + - Intune: Yes + - JamF: Yes + - Other MDM: Yes + - Manual: Must approve the extension by going to Security Preferences or System Preferences > Security & Privacy > Privacy > Full Disk Access and then selecting Allow, and checking the box next to the following: + - Microsoft Defender + - Microsoft Defender Security Extension + +4. + - Function: Running in background + - Mobile config (plist): https://github.com/microsoft/mdatp-xplat/blob/master/macos/mobileconfig/profiles/background_services.mobileconfig + - Applicable to: + - Intune: Yes + - JamF: Yes + - Other MDM: Yes + - Manual: Not applicable + +5. + - Function: Sending notifications + - Mobile config (plist): https://github.com/microsoft/mdatp-xplat/blob/master/macos/mobileconfig/profiles/notif.mobileconfig + - Applicable to: + - Intune: Yes + - JamF: Yes + - Other MDM: Yes + - Manual: Not applicable + +6. + - Function: Accessibility + - Mobile config (plist): https://github.com/microsoft/mdatp-xplat/blob/master/macos/mobileconfig/profiles/accessibility.mobileconfig + - Applicable to: + - Intune: Yes + - JamF: Yes + - Other MDM: Yes + - Manual: Not applicable + +#### Step 3: Test the installed profiles using macOS built-in ΓÇÿprofileΓÇÖ tool. It compares your profiles with what we have published in GitHub, reporting inconsistent profiles or profiles missing altogether + +1. Download the script from https://github.com/microsoft/mdatp-xplat/tree/master/macos/mdm. +1. Click Raw. The new URL will be https://raw.githubusercontent.com/microsoft/mdatp-xplat/master/macos/mdm/analyze_profiles.py. +1. Save it as analyze_profiles.py to Downloads by running the following command in terminal: + +```BashCopy + curl -O https://raw.githubusercontent.com/microsoft/mdatp-xplat/master/macos/mdm/analyze_profiles.py +``` + +4. Run the profile analyzer python3 script without any parameters by executing the following command in terminal: + +```BashCopy + cd /Downloads + sudo python3 analyze_profiles.py +``` + + > [!NOTE] + > Sudo permissions are required to execute this command. + +OR + +5. Run the script directly from the Web by executing the following command: + +```BashCopy + sudo curl https://raw.githubusercontent.com/microsoft/mdatp-xplat/master/macos/mdm/analyze_profiles.py +\| python3 - +``` + + > [!NOTE] + > Sudo permissions are required to execute this command. + +The output will show all potential issues with profiles. + +## Recommended content + +- [Deploying Microsoft Defender for Endpoint on macOS with Jamf Pro](mac-install-with-jamf.md): Learn how to deploy Microsoft Defender for Endpoint on macOS with Jamf Pro. +- [Set up the Microsoft Defender for Endpoint on macOS policies in Jamf Pro](mac-jamfpro-policies.md): Learn how to set up the Microsoft Defender for Endpoint on macOS policies in Jamf Pro. +- [Set up device groups in Jamf Pro](mac-jamfpro-device-groups.md): +Learn how to set up device groups in Jamf Pro for Microsoft Defender for Endpoint on macOS. +- [Log in to Jamf Pro](mac-install-jamfpro-login.md) +
security	Manage Profiles Approve Sys Extensions Intune	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-profiles-approve-sys-extensions-intune.md	+ + Title: Manage profiles and approve extensions using Intune +description: Manage profiles and approve extensions using Intune for Microsoft Defender for Endpoint to work properly on macOS. +keywords: microsoft, defender, Microsoft Defender for Endpoint, mac, performance, big sur, monterey, ventura, mde for mac + +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ++ +ms.localizationpriority: medium + +audience: ITPro + +- m365-security +- tier3 ++ +search.appverid: met150 Last updated : 08/28/2023++ +# Manage profiles and approve extensions using Intune + +This article describes the procedures to follow to manage profiles properly using the Intune management tool. + +## Intune + +### Intune System Extensions Policy + +To approve the system extensions: + +1. In Intune, select Manage > Device configuration, and then select Manage > Profiles > Create Profile. +1. Choose a name for the profile. Change Platform=macOS to Profile type=Extensions, and then select Create. +1. In the Basics tab, give a name to this new profile. +1. In the Configuration settings tab, add the following entries in the Allowed system extensions section: + + \|Bundle identifier \|Team identifier \| + \|\|\| + \|com.microsoft.wdav.epsext \| UBF8T346G9 \| + \|com.microsoft.wdav.netext \| UBF8T346G9 \| + + :::image type="content" source="images/entries-in-configuration-settings-tab.png" alt-text="Adding entries in the Configuration settings tab." lightbox="images/entries-in-configuration-settings-tab.png"::: + +1. In the Assignments tab, assign this profile to All Users & All devices. +1. Review and create this configuration profile. + +### Create the custom configuration profile + +The custom configuration profile enables the network extension and grants Full Disk Access to the Endpoint Security system extension. + +1. Save the following content to a file named sysext.xml: + +```powershell + <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> +<plist version="1"> + <dict> + <key>PayloadUUID</key> + <string>7E53AC50-B88D-4132-99B6-29F7974EAA3C</string> + <key>PayloadType</key> + <string>Configuration</string> + <key>PayloadOrganization</key> + <string>Microsoft Corporation</string> + <key>PayloadIdentifier</key> + <string>7E53AC50-B88D-4132-99B6-29F7974EAA3C</string> + <key>PayloadDisplayName</key> + <string>Microsoft Defender System Extensions</string> + <key>PayloadDescription</key> + <string/> + <key>PayloadVersion</key> + <integer>1</integer> + <key>PayloadEnabled</key> + <true/> + <key>PayloadRemovalDisallowed</key> + <true/> + <key>PayloadScope</key> + <string>System</string> + <key>PayloadContent</key> + <array> + <dict> + <key>PayloadUUID</key> + <string>2BA070D9-2233-4827-AFC1-1F44C8C8E527</string> + <key>PayloadType</key> + <string>com.apple.webcontent-filter</string> + <key>PayloadOrganization</key> + <string>Microsoft Corporation</string> + <key>PayloadIdentifier</key> + <string>CEBF7A71-D9A1-48BD-8CCF-BD9D18EC155A</string> + <key>PayloadDisplayName</key> + <string>Approved Network Extension</string> + <key>PayloadDescription</key> + <string/> + <key>PayloadVersion</key> + <integer>1</integer> + <key>PayloadEnabled</key> + <true/> + <key>FilterType</key> + <string>Plugin</string> + <key>UserDefinedName</key> + <string>Microsoft Defender Network Extension</string> + <key>PluginBundleID</key> + <string>com.microsoft.wdav</string> + <key>FilterSockets</key> + <true/> + <key>FilterDataProviderBundleIdentifier</key> + <string>com.microsoft.wdav.netext</string> + <key>FilterDataProviderDesignatedRequirement</key> + <string>identifier "com.microsoft.wdav.netext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists / and certificate leaf[subject.OU] = UBF8T346G9</string> + </dict> + <dict> + <key>PayloadUUID</key> + <string>56105E89-C7C8-4A95-AEE6-E11B8BEA0366</string> + <key>PayloadType</key> + <string>com.apple.TCC.configuration-profile-policy</string> + <key>PayloadOrganization</key> + <string>Microsoft Corporation</string> + <key>PayloadIdentifier</key> + <string>56105E89-C7C8-4A95-AEE6-E11B8BEA0366</string> + <key>PayloadDisplayName</key> + <string>Privacy Preferences Policy Control</string> + <key>PayloadDescription</key> + <string/> + <key>PayloadVersion</key> + <integer>1</integer> + <key>PayloadEnabled</key> + <true/> + <key>Services</key> + <dict> + <key>SystemPolicyAllFiles</key> + <array> + <dict> + <key>Identifier</key> + <string>com.microsoft.wdav.epsext</string> + <key>CodeRequirement</key> + <string>identifier "com.microsoft.wdav.epsext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] / exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists / and certificate leaf[subject.OU] = UBF8T346G9</string> + <key>IdentifierType</key> + <string>bundleID</string> + <key>StaticCode</key> + <integer>0</integer> + <key>Allowed</key> + <integer>1</integer> + </dict> + </array> + </dict> + </dict> + </array> + </dict> +</plist> +``` + +Verify that the above content was copied into the file correctly. From terminal, run the following command and verify that it outputs to the result as shown in the following example: + +```powershell-interactive +$ plutil -lint sysext.xml +sysext.xml: OK +``` + +### Deploy this custom configuration profile + +1. In Intune, select Manage > Device configuration, and then select Manage > Profiles > Create profile. +1. Choose a name for the profile. For the Platform* attribute, set the value as macOS and for the Profile type attribute, set the value as Custom, and then select Configure. The file sysext.xml is created. +1. Open the configuration profile and upload the sysext.xml file. +1. Select OK. ++ +5. In the Assignments tab, assign this profile to All Users & All devices. +6. Review and create this configuration profile.
security	Manage Sys Extensions Manual Deployment	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-sys-extensions-manual-deployment.md	+ + Title: Manage system extensions using the manual methods of deployment +description: Manage system extensions using the manual methods of deployment. +keywords: microsoft, defender, Microsoft Defender for Endpoint, mac, performance, big sur, monterey, ventura, mde for mac + +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ++ +ms.localizationpriority: medium + +audience: ITPro + +- m365-security +- tier3 ++ +search.appverid: met150 Last updated : 08/28/2023++ +# Manage system extensions using the manual methods of deployment + +This article describes the procedures involved when deploying Microsoft Defender for Endpoint manually. + +## Manual deployment + +### System Extensions + +You might see the prompt that's shown in the following screenshot: ++ +1. Select OK. You might get a second prompt as shown in the following screenshot: + + :::image type="content" source="images/system-extension-blocked-second-prompt.png" alt-text="The second prompt regarding system extensions being blocked." lightbox="images/system-extension-blocked-second-prompt.png"::: + +1. From this second-prompt screen, select OK. You'll receive a notification message that reads Installation succeeded, as shown in the following screenshot: + + :::image type="content" source="images/installation-succeeded-notification-message.png" alt-text="The screen displaying the installation succeeded notification message." lightbox="images/installation-succeeded-notification-message.png"::: + +1. On the screen displaying the Installation succeeded notification message, select OK. You'll return to the following screen: + + :::image type="content" source="images/mde-menu.png" alt-text="The Microsoft Defender for Endpoint menu containing the x symbol." lightbox="images/mde-menu.png"::: + +1. From the menu bar, click the x symbol on the shield. You'll get the options shown in the following screenshot: + + :::image type="content" source="images/options-on-clicking-x-symbol.png" alt-text="The screen on clicking the x symbol in the shield." lightbox="images/options-on-clicking-x-symbol.png"::: + +1. Select Action needed. The following screen appears: + + :::image type="content" source="images/virus-and-threat-protection-screen.png" alt-text="The Virus & threat protection screen containing the Fix button." lightbox="images/virus-and-threat-protection-screen.png"::: + +1. Click Fix on the top-right corner of this screen. You'll get a prompt, as shown in the following screenshot: + + :::image type="content" source="images/prompt-on-virus-and-threat-protection-screen.png" alt-text="The prompt dialog box on the Virus & threat protection screen." lightbox="images/prompt-on-virus-and-threat-protection-screen.png"::: + +1. Enter your password and select OK. +1. Click + :::image type="content" source="images/system-preferences-icon.png" alt-text="The System Preferences icon." lightbox="images/system-preferences-icon.png"::: + + The System Preferences screen appears. + + :::image type="content" source="images/system-preferences-screen.png" alt-text="The System Preferences screen." lightbox="images/system-preferences-screen.png"::: + +1. Click Security & Privacy. The Security & Privacy screen appears. + + :::image type="content" source="images/security-and-privacy-screen.png" alt-text="The Security & Privacy screen." lightbox="images/security-and-privacy-screen.png"::: + +1. Select Click the lock to make changes. You'll get a prompt as shown in the following screenshot: + + :::image type="content" source="images/prompt-on-security-and-privacy-screen.png" alt-text="The prompt on the Security & Privacy screen." lightbox="images/prompt-on-security-and-privacy-screen.png"::: + +1. Enter your password and click Unlock. The following screen appears: + + :::image type="content" source="images/screen-on-clicking-unlock.png" alt-text="The screen that is displayed on clicking Unlock." lightbox="images/screen-on-clicking-unlock.png"::: + +1. Select Details, next to Some software system requires your attention before it can be used. + + :::image type="content" source="images/screen-on-clicking-details.png" alt-text="The screen that is displayed on clicking Details." lightbox="images/screen-on-clicking-details.png"::: + +1. Check both the Microsoft Defender checkboxes, and select OK. You'll get two pop-up screens, as shown in the following screenshot: + + :::image type="content" source="images/popup-after-checking-both-md-checkboxes.png" alt-text="The popup that appears on checking both the checkboxes." lightbox="images/popup-after-checking-both-md-checkboxes.png"::: + +1. On the ΓÇ£Microsoft DefenderΓÇ¥ Would like to Filter Network Content pop-up screen, click Allow. + +1. On the Microsoft Defender wants to make changes pop-up screen, enter your password and select OK. + +If you run systemextensionsctl list, the following screen appears: ++ +### Accessibility + +1. On the Security & Privacy screen, select the Privacy tab. + + :::image type="content" source="images/privacy-tab.png" alt-text="The Privacy tab." lightbox="images/privacy-tab.png"::: + +2. Select Accessibility from the left navigation pane, and click +. + + :::image type="content" source="images/accessibility-and-plus-icon.png" alt-text="The Accessibility menu item and the Plus icon." lightbox="images/accessibility-and-plus-icon.png"::: + +3. From the resultant screen, select Applications from the Favorites pane in the left-side of the screen; select Microsoft Defender; and then select Open at the bottom-right of the screen. + + :::image type="content" source="images/applications-md-options.png" alt-text="The process of selecting Applications and Microsoft Defender." lightbox="images/applications-md-options.png"::: + +4. From the resultant screen, check the Microsoft Defender checkbox. + + :::image type="content" source="images/checking-md-checkbox.png" alt-text="Checking the Microsoft Defender checkbox." lightbox="images/checking-md-checkbox.png"::: + +### Full Disk Access + +1. On the Security & Privacy screen, select the Privacy tab. +1. Select Full Disk Access from the left navigation pane, and then click the Lock icon. + + :::image type="content" source="images/full-disk-access-and-lock-icon.png" alt-text="The Full Disk Access option in the menu and the Lock icon." lightbox="images/full-disk-access-and-lock-icon.png"::: + +1. Confirm that the Microsoft Defender extension has full disk access; if not, check the Microsoft Defender checkbox. + + :::image type="content" source="images/check-md-checkbox.png" alt-text="Checking the MD checkbox." lightbox="images/check-md-checkbox.png"::: + +### Notifications + +1. From the System Preferences home screen, select Notifications. + + :::image type="content" source="images/notifications-option.png" alt-text="The Notifications option in the System Preferences screen." lightbox="images/notifications-option.png"::: + + The Notifications screen appears. + +1. Select Microsoft Defender from the left navigation pane. + +1. Enable the Allow Notifications option; select Alerts, and retain the default settings as is. + + :::image type="content" source="images/notifications-md.png" alt-text="Selecting Microsoft Defender option from the Notifications screen." lightbox="images/notifications-md.png"::: + +### What a healthy system looks like + +#### mdatp health output ++ +#### Check the system extensions + +In terminal, run the following command to check the system extensions: + +`systemextensionsctl list` + +The execution of this command is shown in the following screenshot: +
security	Manage Sys Extensions Other Mdm	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-sys-extensions-other-mdm.md	+ + Title: Manage system extensions using other MDM solutions +description: Manage system extensions using other MDM solutions. +keywords: microsoft, defender, Microsoft Defender for Endpoint, mac, performance, big sur, monterey, ventura, mde for mac + +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ++ +ms.localizationpriority: medium + +audience: ITPro + +- m365-security +- tier3 ++ +search.appverid: met150 Last updated : 08/28/2023++ +# Manage system extensions using other MDM solutions + +This article deals with deployment of Microsoft Defender for Endpoint on macOS using other MDM solutions. For detailed information, see [System configuration profiles](mac-install-with-other-mdm.md).
security	Manage Sys Extensions Using Jamf	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-sys-extensions-using-jamf.md	+ + Title: Manage system extensions using JamF +description: Manage system extensions using JamF for Microsoft Defender for Endpoint to work properly on macOS. +keywords: microsoft, defender, Microsoft Defender for Endpoint, mac, performance, big sur, monterey, ventura, mde for mac + +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ++ +ms.localizationpriority: medium + +audience: ITPro + +- m365-security +- tier3 ++ +search.appverid: met150 Last updated : 08/28/2023++ +# Manage system extensions using JamF + +This article describes the procedures to implement in the process of managing the system extensions to ensure Microsoft Defender for Endpoint works properly on macOS. + +## JamF + +### JAMF System Extensions Policy + +To approve the system extensions, perform the following steps: + +1. Select Computers > Configuration Profiles, and then select Options > System Extensions. +2. Select Allowed System Extensions from the System Extension Types drop-down list. +3. Use UBF8T346G9 for Team ID. +4. Add the following bundle identifiers to the Allowed System Extensions list: + - com.microsoft.wdav.epsext + - com.microsoft.wdav.netext + + :::image type="content" source="images/jamf-system-extensions-approval.png" alt-text="Approving system extensions in JamF." lightbox="images/jamf-system-extensions-approval.png"::: + +### Privacy Preferences Policy Control (also known as Full Disk Access) + +Add the following JAMF payload to grant Full Disk Access to the Microsoft Defender for Endpoint Security Extension. This policy is a prerequisite for running the extension on your device. + +1. Select Options > Privacy Preferences Policy Control. +1. Use com.microsoft.wdav.epsext as the Identifier and Bundle ID as Bundle type. +1. Set Code Requirement to *identifier com.microsoft.wdav.epsext and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] / exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists / and certificate leaf[subject.OU] = UBF8T346G9. +1. Set App or service* to SystemPolicyAllFiles and access to Allow. + + :::image type="content" source="images/privacy-preferences-policy-control.png" alt-text="Privacy preferences policy control." lightbox="images/privacy-preferences-policy-control.png"::: + +### Network Extension Policy + +As part of the Endpoint Detection and Response capabilities, Microsoft Defender for Endpoint on macOS inspects socket traffic and reports this information to the Microsoft 365 Defender portal. The following policy allows the network extension to perform this functionality: + +> [!NOTE] +> JAMF doesn't have built-in support for content filtering policies, which are a prerequisite for enabling the network extensions that Microsoft Defender for Endpoint on macOS installs on the device. Furthermore, JAMF sometimes changes the content of the policies being deployed. As such, the following steps provide a workaround that involves signing the configuration profile. + +1. Save the following content to your device as com.microsoft.network-extension.mobileconfig using a text editor: + +```powershell + <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> +<plist version="1"> + <dict> + <key>PayloadUUID</key> + <string>DA2CC794-488B-4AFF-89F7-6686A7E7B8AB</string> + <key>PayloadType</key> + <string>Configuration</string> + <key>PayloadOrganization</key> + <string>Microsoft Corporation</string> + <key>PayloadIdentifier</key> + <string>DA2CC794-488B-4AFF-89F7-6686A7E7B8AB</string> + <key>PayloadDisplayName</key> + <string>Microsoft Defender Network Extension</string> + <key>PayloadDescription</key> + <string/> + <key>PayloadVersion</key> + <integer>1</integer> + <key>PayloadEnabled</key> + <true/> + <key>PayloadRemovalDisallowed</key> + <true/> + <key>PayloadScope</key> + <string>System</string> + <key>PayloadContent</key> + <array> + <dict> + <key>PayloadUUID</key> + <string>2BA070D9-2233-4827-AFC1-1F44C8C8E527</string> + <key>PayloadType</key> + <string>com.apple.webcontent-filter</string> + <key>PayloadOrganization</key> + <string>Microsoft Corporation</string> + <key>PayloadIdentifier</key> + <string>CEBF7A71-D9A1-48BD-8CCF-BD9D18EC155A</string> + <key>PayloadDisplayName</key> + <string>Approved Network Extension</string> + <key>PayloadDescription</key> + <string/> + <key>PayloadVersion</key> + <integer>1</integer> + <key>PayloadEnabled</key> + <true/> + <key>FilterType</key> + <string>Plugin</string> + <key>UserDefinedName</key> + <string>Microsoft Defender Network Extension</string> + <key>PluginBundleID</key> + <string>com.microsoft.wdav</string> + <key>FilterSockets</key> + <true/> + <key>FilterDataProviderBundleIdentifier</key> + <string>com.microsoft.wdav.netext</string> + <key>FilterDataProviderDesignatedRequirement</key> + <string>identifier "com.microsoft.wdav.netext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists / and certificate leaf[subject.OU] = UBF8T346G9</string> + </dict> + </array> + </dict> +</plist> +``` + +2. Verify that the above content was copied correctly into the file by running the plutil* utility in terminal: + +```BashCopy +$ plutil -lint <PathToFile>/com.microsoft.network-extension.mobileconfig +``` +For example, if the file was stored in Documents: + +```BashCopy +$ plutil -lint ~/Documents/com.microsoft.network-extension.mobileconfig +``` + +3. Verify that the command outputs OK + +```BashCopy +<PathToFile>/com.microsoft.network-extension.mobileconfig: OK +``` + +5. Follow the instructions on [this page](https://learn.jamf.com/bundle/technical-articles/page/Welcome.html) to create a signing certificate using JAMF's built-in certificate authority. +5. After the certificate is created and installed to your device, run the following command from terminal to sign the file: + +```BashCopy +$ security cms -S -N "<CertificateName>" -i <PathToFile>/com.microsoft.network-extension.mobileconfig -o <PathToSignedFile>/com.microsoft.network-extension.signed.mobileconfig +``` + +For example, if the certificate name is SigningCertificate and the signed file is going to be stored in Documents: + +```BashCopy +$ security cms -S -N "SigningCertificate" -i ~/Documents/com.microsoft.network-extension.mobileconfig -o ~/Documents/com.microsoft.network-extension.signed.mobileconfig +``` + +6. From the JAMF portal, navigate to Configuration Profiles and select the Upload button. Select com.microsoft.network-extension.signed.mobileconfig when prompted for the file.
security	Microsoft Defender Antivirus Pilot Ring Deployment Group Policy Wsus	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-pilot-ring-deployment-group-policy-wsus.md	The Windows Server Update Services Configuration Wizard is complete. :::image type="content" source="images/microsoft-defender-antivirus-deploy-ring-group-policy-wsus-report-viewer-kb-update-info.png" alt-text="Screenshot that shows a screen capture with details about a KB update reported in Update Report for Yr2k19." lightbox="images/microsoft-defender-antivirus-deploy-ring-group-policy-wsus-report-viewer-kb-update-info.png"::: - To learn more about the different Microsoft Defender Antivirus Update channels, see [Manage the gradual rollout process for Microsoft Defender updates](/manage-gradual-rollout) + To learn more about the different Microsoft Defender Antivirus Update channels, see [Manage the gradual rollout process for Microsoft Defender updates](manage-gradual-rollout.md) #### To find out which Platform Update version is the Current Channel (Broad) The Windows Server Update Services Configuration Wizard is complete. In Step 3: Specify a name, type a name for your rule. For example, type _Microsoft Defender Antivirus updates_. These settings are shown in the following figure: - :::image type="content" source="images/microsoft-defender-antivirus-deploy-ring-group-policy-wsus-updates-add-rule.png" alt-text="Screenshot that shows a screen capture of the an example name for a rule." lightbox="images/microsoft-defender-antivirus-deploy-ring-group-policy-wsus-updates-add-rule.png"::: + :::image type="content" source="images/microsoft-defender-antivirus-deploy-ring-group-policy-wsus-updates-add-rule.png" alt-text="Screenshot that shows a screen capture of an example name for a rule." lightbox="images/microsoft-defender-antivirus-deploy-ring-group-policy-wsus-updates-add-rule.png"::: 1. Select OK. The work flow returns to the Update Rules page. Select your new rule, For example, select Microsoft Defender Antivirus updates. 1. In Rule Properties, verify the information is correct, and then select OK.
security	Microsoft Defender Antivirus Ring Deployment Group Policy Microsoft Update	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-ring-deployment-group-policy-microsoft-update.md	In [Group Policy Management Console](/previous-versions/windows/it-pro/windows-s The three options are shown in the following figure. - :::image type="content" source="images/microsoft-defender-antivirus-deploy-ring-gp-microsoft-defender-antivirus-channels.png" alt-text="Screenshot that shows a screen capture of the pilot Computer Configuration > Policies > Administrative Templates > Windows Components > Microsoft Defender Antivirus update channels." lightbox="images/microsoft-defender-antivirus-deploy-ring-gp-microsoft-defender-antivirus-channels.png"::: + :::image type="content" source="images/microsoft-defender-antivirus-deploy-ring-gp-microsoft-defender-antivirus-channels.png" alt-text="Screenshot that shows a screen capture of the pilot Computer Configuration > Policies > Administrative Templates > Windows Components > Microsoft Defender Antivirus update channels." lightbox="images/microsoft-defender-antivirus-deploy-ring-gp-microsoft-defender-antivirus-channels.png"::: - For more information, see [Manage the gradual rollout process for Microsoft Defender updates](/manage-gradual-rollout) + For more information, see [Manage the gradual rollout process for Microsoft Defender updates](manage-gradual-rollout.md) -1. Go to Computer Configuration > Policies > Administrative Templates > Windows Components > Microsoft Defender Antivirus. +1. Go to Computer Configuration > Policies > Administrative Templates > Windows Components > Microsoft Defender Antivirus. 1. For _intelligence_ updates, double-click Select the channel for Microsoft Defender monthly intelligence updates. If you encounter problems with your deployment, create or append your Microsoft 1. The change is active when Group Policy updates. There are two methods to refresh Group Policy: - - From the command line, run the Group Policy update command. For example, run `gpupdate / force`. For more information, see [gpupdate](/windows-server/administration/windows-commands/gpupdate.md) + - From the command line, run the Group Policy update command. For example, run `gpupdate / force`. For more information, see [gpupdate](/windows-server/administration/windows-commands/gpupdate) - Wait for Group Policy to automatically refresh. Group Policy refreshes every 90 minutes +/- 30 minutes. If you have multiple forests/domains, force replication or wait 10-15 minutes. Then force a Group Policy Update from the Group Policy Management Console. If you encounter problems with your deployment, create or append your Microsoft 1. After the issue is resolved, set the Signature Update Fallback Order back to the original setting. `InternalDefinitionUpdateServder\|MicrosoftUpdateServer\|MMPC\|FileShare`. - ## See also - [Antivirus profiles - Devices managed by Microsoft Intune](/mem/intune/protect/endpoint-security-antivirus-policy#antivirus-profiles)
security	Microsoft Defender Antivirus Ring Deployment Group Policy Network Share	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-ring-deployment-group-policy-network-share.md	Set up a network file share (UNC/mapped drive) to download security intelligence MD C:\Temp\TempSigs\x86 ``` -3. Setup a PowerShell script, `CopySignatures.ps1` +3. Set up a PowerShell script, `CopySignatures.ps1` Copy-Item -Path ΓÇ£\\SourceServer\SourcefolderΓÇ¥ -Destination ΓÇ£\\TargetServer\TargetfolderΓÇ¥ In [Group Policy Management Console](/previous-versions/windows/it-pro/windows-s The three options are shown in the following figure. - :::image type="content" source="images/microsoft-defender-antivirus-deploy-ring-gp-microsoft-defender-antivirus-channels.png" alt-text="Screenshot that shows a screen capture of the pilot Computer Configuration > Policies > Administrative Templates > Windows Components > Microsoft Defender Antivirus update channels." lightbox="images/microsoft-defender-antivirus-deploy-ring-gp-microsoft-defender-antivirus-channels.png"::: + :::image type="content" source="images/microsoft-defender-antivirus-deploy-ring-gp-microsoft-defender-antivirus-channels.png" alt-text="Screenshot that shows a screen capture of the pilot Computer Configuration > Policies > Administrative Templates > Windows Components > Microsoft Defender Antivirus update channels." lightbox="images/microsoft-defender-antivirus-deploy-ring-gp-microsoft-defender-antivirus-channels.png"::: - For more information, see [Manage the gradual rollout process for Microsoft Defender updates](/manage-gradual-rollout) + For more information, see [Manage the gradual rollout process for Microsoft Defender updates](manage-gradual-rollout.md) -1. Go to Computer Configuration > Policies > Administrative Templates > Windows Components > Microsoft Defender Antivirus. +1. Go to Computer Configuration > Policies > Administrative Templates > Windows Components > Microsoft Defender Antivirus. 1. For _intelligence_ updates, double-click Select the channel for Microsoft Defender monthly intelligence updates.
security	Microsoft Defender Antivirus Updates	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-updates.md	Title: Microsoft Defender Antivirus security intelligence and product updates description: Manage how Microsoft Defender Antivirus receives protection and product updates. ms.localizationpriority: high Previously updated : 08/07/2023 Last updated : 08/30/2023 audience: ITPro All our updates contain - Serviceability improvements - Integration improvements (Cloud, [Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-defender)) +### August-2023 (Platform: 4.18.23080.2006 \| Engine: 1.1.23080.2005) + +- Security intelligence update version: 1.397.59.0 +- Released: August 30, 2023 (Platform and Engine) +- Platform: 4.18.23080.2006 +- Engine: 1.1.23080.2005 +- Support phase: Security and Critical Updates + +### What's new + +- Fixed an issue where Microsoft Defender Antivirus switched from [passive mode to active mode](microsoft-defender-antivirus-windows.md#comparing-active-mode-passive-mode-and-disabled-mode) following an update on Windows Server 2016 and Windows Server 2012 R2 [onboarded using the modern, unified client](configure-server-endpoints.md) +- Fixed an issue where [exclusions](defender-endpoint-antivirus-exclusions.md) were not applied correctly using [gpupdate](/windows-server/administration/windows-commands/gpupdate) when registry policy processing was set to process even if Group Policy Objects did not change +- Excluded IP addresses can now be configured using [Intune](/windows/client-management/mdm/defender-csp#configurationexcludedipaddresses) +- Improved [tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) on Windows Server 2016 +- [DisableFtpParsing](/windows/client-management/mdm/defender-csp#configurationdisableftpparsing) can now be configured through [Set-MpPreference](/powershell/module/defender/set-mppreference) +- Fixed an issue where [device control](device-control-removable-storage-protection.md) policies were not applied correctly without a reboot following product updates +- Fixed an issue in the attack surface reduction rule, [Block Win32 API calls from Office macros](attack-surface-reduction-rules-reference.md#block-win32-api-calls-from-office-macros), configured in warn mode where excluded files were incorrectly blocked until the next device reboot ++ +### Known issues + +- None + ### July-2023 (Platform: 4.18.23070.1004 \| Engine: 1.1.23070.1005) - Security intelligence update version: 1.395.30.0 All our updates contain - Users encounter slow loading webpages in non-Microsoft web browsers with [web content filtering](/microsoft-365/security/defender-endpoint/web-content-filtering) enabled -### May-2023 (Platform: 4.18.23050.3 \| Engine: 1.1.23050.2) --- Security intelligence update version: 1.391.64.0 -- Released: May 31, 2023 -- Platform: 4.18.23050.3 -- Engine: 1.1.23050.2 -- Support phase: Security and Critical Updates - -#### What's new --- New version format for Platform and Engine (see the [April-2023 update](#whats-new))-- Improved processing of SmartLockerMode -- Fixed input parameters for DefinitionUpdateChannel cmdlet in [Set-MpPreference](/powershell/module/defender/set-mppreference) -- Improved installation experience for [Windows Server 2012 R2 and Windows Server 2016](microsoft-defender-antivirus-on-windows-server.md) -- Added ability to disable Defender task maintenance tasks programmatically -- Fixed WDFilter 0x50 bug check -- Fixed print enforcement issue for device control -- Fixed scan randomization issue when setting Intune policy -- Fixed sense offboarding on Windows Server 2016 when [tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) is enabled -- Fixed inconsistent results of caching files with the internal Defender file cache -- Augmented attack surface reduction (ASR) telemetry with more data related to an ASR detection -- Removed Image File Execution Options (IFEO) debugger value during installation, which can be used to prevent service starts-- Fixed memory leaked in ASR logic -- Improved validation guard-rail for Malicious Software Removal Tool (MSRT) releases - -#### Known Issues --- Potential issue that could lead to resolution of incorrect service endpoint ### Previous version updates: Technical upgrade support only
security	Msda Updates Previous Versions Technical Upgrade Support	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/msda-updates-previous-versions-technical-upgrade-support.md	ms.localizationpriority: medium Previously updated : 08/07/2023 Last updated : 08/29/2023 audience: ITPro search.appverid: met150 Microsoft regularly releases [security intelligence updates and product updates for Microsoft Defender Antivirus](microsoft-defender-antivirus-updates.md). It's important to keep Microsoft Defender Antivirus up to date. When a new package version is released, support for the previous two versions is reduced to technical support only. Versions that are older than the previous two versions are listed in this article and are provided for technical upgrade support only. +## May-2023 (Platform: 4.18.23050.3 \| Engine: 1.1.23050.2) + +- Security intelligence update version: 1.391.64.0 +- Released: May 31, 2023 +- Platform: 4.18.23050.3 +- Engine: 1.1.23050.2 +- Support phase: Technical upgrade support (only) + +### What's new + +- New version format for Platform and Engine (see the [April-2023 update](#whats-new)) +- Improved processing of SmartLockerMode +- Fixed input parameters for DefinitionUpdateChannel cmdlet in [Set-MpPreference](/powershell/module/defender/set-mppreference) +- Improved installation experience for [Windows Server 2012 R2 and Windows Server 2016](microsoft-defender-antivirus-on-windows-server.md) +- Added ability to disable Defender task maintenance tasks programmatically +- Fixed WDFilter 0x50 bug check +- Fixed print enforcement issue for device control +- Fixed scan randomization issue when setting Intune policy +- Fixed sense offboarding on Windows Server 2016 when [tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) is enabled +- Fixed inconsistent results of caching files with the internal Defender file cache +- Augmented attack surface reduction (ASR) telemetry with more data related to an ASR detection +- Removed Image File Execution Options (IFEO) debugger value during installation, which can be used to prevent service starts +- Fixed memory leaked in ASR logic +- Improved validation guard-rail for Malicious Software Removal Tool (MSRT) releases + +### Known Issues + +- Potential issue that could lead to resolution of incorrect service endpoint + ## April-2023 (Platform: 4.18.2304.8 \| Engine: 1.1.20300.3) - Security intelligence update version: 1.387.2997.0
security	Network Protection Linux	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/network-protection-linux.md	sudo python3 MicrosoftDefenderATPOnboardingLinuxServer.py ### Validation A. Check Network Protection has effect on always blocked sites:- +<!--These links are purposely blocked; will trigger as broken link> - [http://www.smartscreentestratings2.net](http://www.smartscreentestratings2.net) - [https://www.smartscreentestratings2.net](https://www.smartscreentestratings2.net) The default values were tested for all distributions as described in [Microsoft Also, make sure that in Microsoft Defender \> Settings \> Endpoints \> Advanced features that 'Custom network indicators' toggle is set _enabled_. > [!IMPORTANT] -> The above 'Custom network indicators' toggle controls Custom Indicators enablement for ALL platforms with Network Protection support, including Windows. Reminder that - on Windows - for indicators to be enforced you also must have Network Protection explicitly enabled. +> The above 'Custom network indicators' toggle controls Custom Indicators enablement for ALL platforms** with Network Protection support, including Windows. Reminder thatΓÇöon WindowsΓÇöfor indicators to be enforced you also must have Network Protection explicitly enabled. ->:::image type="content" source="images/network-protection-linux-defender-security-center-advanced-features-settings.png" alt-text="MEM Create Profile" lightbox="images/network-protection-linux-defender-security-center-advanced-features-settings.png"::: ## How to explore the features Create indicators that define the detection, prevention, and exclusion of entiti Currently supported sources are the cloud detection engine of Defender for Endpoint, the automated investigation and remediation engine, and the endpoint prevention engine (Microsoft Defender Antivirus). ->:::image type="content" source ="images/network-protection-add-url-domain-indicator.png" alt-text="Shows network protection add URL or domain indicator." lightbox="images/network-protection-add-url-domain-indicator.png"::: For more information, see: [Create indicators for IPs and URLs/domains](indicator-ip-domain.md). Configure policies across your device groups to block certain categories. Blocki Web content filtering is available on the major web browsers, with blocks performed by Windows Defender SmartScreen (Microsoft Edge) and Network Protection (Chrome, Firefox, Brave, and Opera). For more information about browser support, see [Prerequisites](#prerequisites). -> :::image type="content" source="images/network-protection-wcf-add-policy.png" alt-text="Shows network protection web content filtering add policy." lightbox="images/network-protection-wcf-add-policy.png"::: For more information about reporting, see [Web content filtering](web-content-filtering.md). For more information about reporting, see [Web content filtering](web-content-fi The Microsoft Defender for Cloud Apps / Cloud App Catalog identifies apps you would want end users to be warned upon accessing with Microsoft 365 Defender for Endpoint, and mark them as _Monitored_. The domains listed under monitored apps would be later synced to Microsoft 365 Defender for Endpoint: -> :::image type="content" source="images/network-protection-macos-mcas-monitored-apps.png" alt-text="Shows network protection mcas monitored apps." lightbox="images/network-protection-macos-mcas-monitored-apps.png"::: Within 10-15 minutes, these domains will be listed in Microsoft 365 Defender under Indicators > URLs/Domains with Action=Warn. Within the enforcement SLA (see details at the end of this article). -> :::image type="content" source="images/network-protection-macos-mcas-cloud-app-security.png" alt-text="Shows network protection mcas cloud app security." lightbox="images/network-protection-macos-mcas-cloud-app-security.png"::: ## See also
security	Professional Services	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/professional-services.md	Managed security services that assist organizations to detect threats early and \|[Cloud Control - Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2202678)\|The Collective\|The Collective's Cloud Control Managed Protection, Detection and Response services is an enterprise grade managed service, delivering true Security Operations Center-as-a-Service (SOC) experience with a personal touch.\| \|[Nedscaper Managed XDR](https://go.microsoft.com/fwlink/?linkid=2202478)\|Nedscaper\|Nedscaper Manager XDR (MDR) is a Managed Detect and Respond SaaS solution, which provides 24/7 Threat Protection, continues Vulnerability Management and combined Threat Intelligence built on Azure. The Microsoft (365 & Azure) Defender products, plus any non-Microsoft / 3P Security solution, is connected to Microsoft Sentinel as the core platform for the Security analysts.\| \|[dinext. pi-SOC](https://go.microsoft.com/fwlink/?linkid=2202581)\|dinext AG\|Through a close integration of deployment support, security operations and consulting in hardening and architectural improvements, dinext AG accompanies customers holistically on their way to a modern security environment.\| -\|[Synergy Advisors Teams App](https://go.microsoft.com/fwlink/?linkid=2202392)\|Synergy Advisors LLC\|E-Visor Teams App is a centralized place to involve and empower your end-users in the security and productivity of the organization by presenting unique information using data from Microsoft Defenders and Azure Active Directory while ensuring identity governance, and compliance.\| +\|[Synergy Advisors Teams App](https://synergyadvisors.biz/e-visor-teams-app/)\|Synergy Advisors LLC\|E-Visor Teams App is a centralized place to involve and empower your end-users in the security and productivity of the organization by presenting unique information using data from Microsoft Defenders and Azure Active Directory while ensuring identity governance, and compliance.\| \|[Managed Microsoft XDR](https://go.cyberproof.com/hubfs/CyberProof_Managed%20XDR%20for%20Microsoft_2022_06.pdf)\|Quorum Cyber\|Quorum Cyber's Managed Microsoft XDR, a solution designed to enable customers to unleash the power of Microsoft security to reduce cyber risk and maximize return of investment in security.\| \|[SecureShield365](https://patriotconsultingtech.com/)\|Patriot Consulting\|SecureShield365 includes a full deployment of all Microsoft 365 Defender products including Intune plus 12 months of support. Microsoft XDR including Sentinel, Defender for Cloud, and MDR are available options.\| \|[Open Systems MDR+](https://go.microsoft.com/fwlink/?linkid=2208895)\|Open Systems\|Built for Microsoft security customers, MDR+ combines certified experts, exemplary processes, and seamless technology to deliver tailored, 24x7 protection while reducing attack surfaces and MTTR.\| Protect your organization proactively by evaluating your organization's ability \|[Microsoft Consulting Services - Security Operations and Threat Protection Services](https://www.microsoft.com/industrysolutions/solutions/security?activetab=pivot1:primaryr4)\|Microsoft\|The Microsoft Consulting Services (MCS) Security Operations and Threat Protection Services (SOTPS), provides a structured approach to modern Security Operations Center (SOC) design and implementation using effective change management techniques so your security professionals can detect attacks faster and respond more effectively.\| \|[Onevinn Threat Hunting](https://go.microsoft.com/fwlink/?linkid=2202584)\|Onevinn\|If your Internal SOC needs an extra pair of eyes looking for threats, Onevinn's Threat Hunters can be purchased as your extended hunting team.\| \|[Microsoft 365 Security Assessment](https://go.microsoft.com/fwlink/?linkid=2202389)\|Nedscaper\|The Microsoft 365 Security assessment provides a risk-based approach to scan and analyze the security baseline (prevention is better than the cure) and settings of the Microsoft 365 Security products, from Microsoft 365 E3 security products like Azure AD Conditional Access and Microsoft Intune (Microsoft Defender Antivirus policies) to the Microsoft 365 E5 Security products like Microsoft 365 Defender, Azure AD identity Protection and Microsoft Defender for Identity, Devices, Office 365 and Cloud Apps.\| -\|[Invoke Monthly Microsoft 365 Security Assessments](https://go.microsoft.com/fwlink/?linkid=2202583)\|Invoke LLC\|Provides monthly detailed assessment reports of active threats, vulnerabilities active and Phishing/malware campaigns targeted on your Microsoft 365 Environment. Helps with prescribed mitigations for active threats and improvement actions for recurring threats if any.Monitor Secure score and recommendations, giving your security teams an extra set of eyes to stay on top of risks.\| +\|[Invoke Monthly Microsoft 365 Security Assessments](https://go.microsoft.com/fwlink/?linkid=2202583)\|Invoke LLC\|Provides monthly detailed assessment reports of active threats, vulnerabilities active and Phishing/malware campaigns targeted on your Microsoft 365 Environment. Helps with prescribed mitigations for active threats and improvement actions for recurring threats if any. Monitor Secure score and recommendations, giving your security teams an extra set of eyes to stay on top of risks.\| \|[Cloud Security Operations Center](https://go.microsoft.com/fwlink/?linkid=2202671)\|glueckkanja-gab AG\|Monitors your Microsoft Security Solutions 24/7, respond to threats on your behalf and work closely with your IT to continuously improve your security posture.\| \|[Wortell Protect](https://go.microsoft.com/fwlink/?linkid=2202480)\|Wortell\|Wortell offers a 24.7.365 Managed Detection and Response service, SOC-as-a-service, to secure your Azure subscriptions and Microsoft 365 environment. With this managed service, Wortell will provide security monitoring and incident response, and operate Microsoft Defender and (optionally) Microsoft Sentinel on your behalf. The service also includes threat intelligence feeds and custom machine learning models\| \|[InSpark Cloud Security Center](https://go.microsoft.com/fwlink/?linkid=2202387)\|InSpark\|InSparks' Cloud Security Center is a 24x7 Managed Security Solution including SOC services. It continuously provides your Microsoft cloud platform with the highest level of security.\| Protect your organization proactively by evaluating your organization's ability \|[Taegis XDR](https://go.microsoft.com/fwlink/?linkid=2202848)\|Secureworks\|TaegisΓäó ManagedXDR is Secureworks┬« 24x7 managed detection and response service, which helps you detect advanced threats and take the right action. Included threat hunting and incident response capabilities help you scale your security operations as Secureworks uses threat data collected across thousands of customers to improve your security posture. Secureworks' combination of proprietary security analytics software, SecOps expertise, incident response and threat hunting experience, threat intelligence capabilities, and 20-year history of service excellence helps reduce risk to your business.\| \|[Cloud Control - Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2202678)\|The Collective\|The Collective's Cloud Control Managed Protection, Detection and Response services is an enterprise grade managed service, delivering true Security Operations Center-as-a-Service (SOC) experience with a personal touch.\| \|[dinext. pi-SOC](https://go.microsoft.com/fwlink/?linkid=2202581)\|dinext AG\|Through a close integration of deployment support, security operations and consulting in hardening and architectural improvements, dinext AG accompanies customers holistically on their way to a modern security environment.\| -\|[Synergy Advisors Teams App](https://go.microsoft.com/fwlink/?linkid=2202392)\|Synergy Advisors LLC\|E-Visor Teams App is a centralized place to involve and empower your end-users in the security and productivity of the organization by presenting unique information using data from Microsoft Defenders and Azure Active Directory while ensuring identity governance, and compliance.\| +\|[Synergy Advisors Teams App](https://synergyadvisors.biz/e-visor-teams-app/)\|Synergy Advisors LLC\|E-Visor Teams App is a centralized place to involve and empower your end-users in the security and productivity of the organization by presenting unique information using data from Microsoft Defenders and Azure Active Directory while ensuring identity governance, and compliance.\| \|[Managed Microsoft XDR](https://go.cyberproof.com/hubfs/CyberProof_Managed%20XDR%20for%20Microsoft_2022_06.pdf)\|Quorum Cyber\|Quorum Cyber's Managed Microsoft XDR, a solution designed to enable customers to unleash the power of Microsoft security to reduce cyber risk and maximize return of investment in security.\| \|[SepagoSOC](https://go.microsoft.com/fwlink/?linkid=2202677)\|Sepago GmbH\|SepagoSOC experts ensure that your environment is constantly monitored and protected utilizing the complete range of Microsoft 365 Defender solutions and Microsoft Sentinel. They help you to constantly evolve your security landscape with both technical and organizational experience.\| \|[SecureShield365](https://patriotconsultingtech.com/)\|Patriot Consulting\|SecureShield365 includes a full deployment of all Microsoft 365 Defender products including Intune plus 12 months of support. Microsoft XDR including Sentinel, Defender for Cloud, and MDR are available options.\| Mature and maintain your internal team's security capabilities to prevent, detec \|[BlueVoyant MDR for Microsoft 365 Defender](https://www.bluevoyant.com/platform/mdr/mdr-for-microsoft)\|BlueVoyant\|BlueVoyant's MDR (Managed Detection and Response) for Microsoft 365 Defender combines the power of Microsoft's Defender product suite with BlueVoyant's elite 24x7 security operations team to identify, investigate and eradicate today's most sophisticated and advanced cyberattacks. In addition to MDR, services can include implementation, assessments, training, concierge, third party integrations, and more.\| \|[White Hat Managed Security Services](https://go.microsoft.com/fwlink/?linkid=2202391)\|White Hat IT Security\|White Hat MSS offers zero trust approach to managed security on every platform ΓÇô scalable and adaptive security from true experts.\| \|[Cloud Control - Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2202678)\|The Collective\|The Collective's Cloud Control Managed Protection, Detection and Response services is an enterprise grade managed service, delivering true Security Operations Center-as-a-Service (SOC) experience with a personal touch.\| -\|[Synergy Advisors Teams App](https://go.microsoft.com/fwlink/?linkid=2202392)\|Synergy Advisors LLC\|E-Visor Teams App is a centralized place to involve and empower your end-users in the security and productivity of the organization by presenting unique information using data from Microsoft Defenders and Azure Active Directory while ensuring identity governance, and compliance.\| +\|[Synergy Advisors Teams App](https://synergyadvisors.biz/e-visor-teams-app/)\|Synergy Advisors LLC\|E-Visor Teams App is a centralized place to involve and empower your end-users in the security and productivity of the organization by presenting unique information using data from Microsoft Defenders and Azure Active Directory while ensuring identity governance, and compliance.\| \|[Managed Microsoft XDR](https://go.cyberproof.com/hubfs/CyberProof_Managed%20XDR%20for%20Microsoft_2022_06.pdf)\|Quorum Cyber\|Quorum Cyber's Managed Microsoft XDR, a solution designed to enable customers to unleash the power of Microsoft security to reduce cyber risk and maximize return of investment in security.\| \|[SecureShield365](https://patriotconsultingtech.com/)\|Patriot Consulting\|SecureShield365 includes a full deployment of all Microsoft 365 Defender products including Intune plus 12 months of support. Microsoft XDR including Sentinel, Defender for Cloud, and MDR are available options.\|
security	Troubleshoot Onboarding	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-onboarding.md	If the script fails and the event is an error, you can check the event ID in the \|`35`\|The script failed to find needed onboarding status registry value\|When the SENSE service starts for the first time, it writes onboarding status to the registry location <p> `HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status`. <p> The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md).\| \|`40`\|SENSE service onboarding status isn't set to 1\|The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md).\| \|`65`\|Insufficient privileges\|Run the script again with administrator privileges.\| +\|`70`\|Offboarding script is for a different organization\|Get an offboarding script for the correct organization that the SENSE service is onboarded to.\| \| ### Troubleshoot onboarding issues using Microsoft Intune
security	Update Agent Mma Windows	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/update-agent-mma-windows.md	search.appverid: met150 # Updating MMA on Windows devices for Microsoft Defender for Endpoint > [!IMPORTANT] -> If you've arrived on this page as a result of clicking on a notification at the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), you have devices in your environment with outdated agents, and you need to take action (see below) to avoid service disruption. For more details, please reference message center post MC598631 (requires access to [Message Center](/microsoft-365/admin/manage/message-center])). +> If you've arrived on this page as a result of clicking on a notification at the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), you have devices in your environment with outdated agents, and you need to take action (see below) to avoid service disruption. For more details, please reference message center post MC598631 (requires access to [Message Center](/microsoft-365/admin/manage/message-center)). Applies to: - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/?linkid=2154037) If you're using the Microsoft Monitoring Agent (MMA) on Windows devices, it's im ## Update MMA on your devices -This option applies to devices running Windows 7 SP1 Enterprise, Windows 7 SP1 Pro, Windows 8.1 Pro, Windows 8.1 Enterprise, and Windows Server 2008 R2 SP1. +This option applies to devices running Windows 7 SP1 Enterprise, Windows 7 SP1 Pro, Windows 8.1 Pro, Windows 8.1 Enterprise, and Windows Server 2008 R2 SP1. - To help you identify older versions of the MMA inside of your organization, you can use the "EOSDate" column in advanced hunting. Or, follow the instructions in [Plan for end-of-support software and software versions](/microsoft-365/security/defender-vulnerability-management/tvm-end-of-support-software) to use the vulnerability management feature inside of Microsoft Defender for Endpoint to track remediation. A new agent was released in April 2022 for Windows Server 2012 R2 and Windows Se - If you've determined that you aren't using the MMA for Defender for Endpoint, or you've already updated your agent, no other steps are needed. -- If you are, however, still using MMA for other purposes (such as Log Analytics), MMA is currently set to retire in August 2024. See [We're retiring the Log Analytics agent in Azure Monitor on 31 August 2024](https://azure.microsoft.com/updates/were-retiring-the-log-analytics-agent-in-azure-monitor-on-31-august-2024/). Depending your particular scenario, this could be a good time to upgrade to [Azure Monitoring Agent, the successor of MMA](/azure/azure-monitor/agents/azure-monitor-agent-migration). +- If you are, however, still using MMA for other purposes (such as Log Analytics), MMA is currently set to retire in August 2024. See [We're retiring the Log Analytics agent in Azure Monitor on 31 August 2024](https://azure.microsoft.com/updates/were-retiring-the-log-analytics-agent-in-azure-monitor-on-31-august-2024/). Depending on your particular scenario, this could be a good time to upgrade to [Azure Monitoring Agent, the successor of MMA](/azure/azure-monitor/agents/azure-monitor-agent-migration). > [!IMPORTANT] > Devices running Windows 7 SP1, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2, or Windows Server 2016 that haven't been upgraded to the [new, unified solution](application-deployment-via-mecm.md) will remain dependent on MMA. In such cases, [AMA](/azure/azure-monitor/agents/agents-overview) cannot be used as a substitute for Defender for Endpoint.
security	Whats New In Microsoft Defender Endpoint	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint.md	For more information on Microsoft Defender for Endpoint on specific operating sy - [What's new in Defender for Endpoint on Linux](linux-whatsnew.md) +## August 2023 + +- (GA) The [Monthly security summary report](monthly-security-summary-report.md) is now generally available. The report helps organizations get a visual summary of key findings and overall preventative actions taken to enhance the organization's overall security posture completed in the last month. + ## July 2023
security	Eval Overview	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-overview.md	Microsoft 365 Defender is made up of these security technologies, operating in t \|Component\|Description\|Reference material\| \|\|\|\| \|Microsoft Defender for Identity\|Microsoft Defender for Identity uses Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization.\|[What is Microsoft Defender for Identity?](/defender-for-identity/what-is)\| -\|Exchange Online Protection\|Exchange Online Protection is the native cloud-based SMTP relay and filtering service that helps protect your organization against spam and malware.\|[Exchange Online Protection (EOP) overview - Office 365](/microsoft-365/office-365-security/eop-about)\| -\|Microsoft Defender for Office 365\|Microsoft Defender for Office 365 safeguards your organization against malicious threats posed by email messages, links (URLs) and collaboration tools.\|[Microsoft Defender for Office 365 - Office 365](/microsoft-365/office-365-security/defender-for-office-365)\| +\|Exchange Online Protection\|Exchange Online Protection is the native cloud-based SMTP relay and filtering service that helps protect your organization against spam and malware.\|[Exchange Online Protection (EOP) overview - Office 365](../office-365-security/eop-about.md)\| +\|Microsoft Defender for Office 365\|Microsoft Defender for Office 365 safeguards your organization against malicious threats posed by email messages, links (URLs) and collaboration tools.\|[Microsoft Defender for Office 365 - Office 365](/microsoft-365/security/office-365-security/defender-for-office-365-whats-new)\| \|Microsoft Defender for Endpoint\|Microsoft Defender for Endpoint is a unified platform for device protection, post-breach detection, automated investigation, and recommended response.\|[Microsoft Defender for Endpoint - Windows security](../defender-endpoint/microsoft-defender-endpoint.md)\| \|Microsoft Defender for Cloud Apps\|Microsoft Defender for Cloud Apps is a comprehensive cross-SaaS solution bringing deep visibility, strong data controls, and enhanced threat protection to your cloud apps.\|[What is Defender for Cloud Apps?](/cloud-app-security/what-is-cloud-app-security)\| \|Azure AD Identity Protection\|Azure AD Identity Protection evaluates risk data from billions of sign-in attempts and uses this data to evaluate the risk of each sign-in to your environment. This data is used by Azure AD to allow or prevent account access, depending on how Conditional Access policies are configured. Azure AD Identity Protection is licensed separately from Microsoft 365 Defender. It is included with Azure Active Directory Premium P2.\|[What is Identity Protection?](/azure/active-directory/identity-protection/overview-identity-protection)\|
security	Microsoft 365 Security Mde Redirection	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-mde-redirection.md	Once disabled, accounts will no longer be routed to security.microsoft.com, and - [Microsoft 365 Defender overview](microsoft-365-defender.md) - [Microsoft Defender for Endpoint in Microsoft 365 Defender](microsoft-365-security-center-mde.md) - [Microsoft delivers unified SIEM and XDR to modernize security operations](https://www.microsoft.com/security/blog/?p=91813)-- [XDR versus SIEM infographic](https://afrait.com/blog/xdr-versus-siem/)-- [`The New Defender`](https://afrait.com/blog/the-new-defender/) - [About Microsoft 365 Defender](https://www.microsoft.com/microsoft-365/security/microsoft-365-defender) - [Microsoft security portals and admin centers](portals.md) [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/defender-m3d-techcommunity.md)]
security	Start Using Mdex Xdr	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/start-using-mdex-xdr.md	Otherwise, if an incident is classified as _True Positive_, our experts then ide - If you have granted Defender Experts for XDR the recommended Security Operator access permissions, our experts could perform the recommended response actions on the incident on your behalf. These actions, along with an Investigation summary, show up in the incident's [Managed response](#how-to-use-managed-response-in-microsoft-365-defender) flyout panel in your Microsoft 365 Defender portal for you or your SOC team to review. Once our experts conclude their work on the incident, its Status field is then updated to _Resolved_ and the Assigned to field is updated to _Unassigned_. -- If you have granted Defender Experts for XDR the default Security Reader access, then the recommended response actions, along with an Investigation summary, show up in the incident's Managed response flyout panel in your Microsoft 365 Defender portal for you or your SOC team to perform. To identify this handover, the incident's Status field is updated to _Awaiting Customer Action_ and Assigned to field is updated to _Customer_. +- If you have granted Defender Experts for XDR the default Security Reader access, then the recommended response actions, along with an Investigation summary, show up in the incident's Managed response flyout panel in your Microsoft 365 Defender portal for you or your SOC team to perform. To identify this handover, the incident's Status field is updated to _Awaiting Customer Action_ and its Assigned to field is updated to _Customer_. You can check the number of incidents that are awaiting your action in the Defender Experts card in your Microsoft 365 Defender portal: You can get incident visibility in Microsoft Sentinel by turning on its out-of-t Once you have turned on the connector, updates by Defender Experts to the Status, Assigned to, Classification, and Determination fields in Microsoft 365 Defender will show up in the corresponding Status, Owner, and Reason for closing fields in Sentinel. > [!NOTE] -> The status of Defender Experts investigated incidents in Microsoft 365 Defender typically transitions from _Active_ to _In progress_ to _Awaiting Customer Action_, while in Sentinel, it follows the _New_ to _Active_ to _Resolved_ path. The Microsoft 365 Defender Status _Awaiting Customer Action_ does not have an equivalent field in Sentinel, instead a tag _Awaiting Customer Action_ is available in Sentinel.ΓÇ¥ +> The status of incidents investigated by Defender Experts in Microsoft 365 Defender typically transitions from _Active_ to _In progress_ to _Awaiting Customer Action_ to _Resolved_, while in Sentinel, it follows the _New_ to _Active_ to _Resolved_ path. The Microsoft 365 Defender Status *Awaiting Customer Action* doesn't have an equivalent field in Sentinel; instead, it's displayed as a tag in an incident in Sentinel. The following section describes how an incident handled by our experts is updated in Sentinel as it progresses through the investigation journey: 1. An incident being investigated by our experts has the Status listed as _Active_ and the Owner listed as _Defender Experts_. 1. An incident that our experts have confirmed as a _True Positive_ has a managed response posted in Microsoft 365 Defender, and a Tag _Awaiting Customer Action_ and the Owner is listed as _Customer_. You need to act on the incident based on using the provided managed response. -1. Once our experts have concluded their investigation and closed an incident as _False Positive_ or _Informational_, _Expected Activity_, the incident's Status is updated to _Resolved_, Owner is listed as _Customer_, and a Reason for closing is provided. +1. Once our experts have concluded their investigation and closed an incident as _False Positive_ or _Informational_, _Expected Activity_, the incident's Status is updated to _Resolved_, the Owner is updated to _Unassigned_, and a Reason for closing is provided. :::image type="content" source="../../media/xdr/microsoft-sentinel-incidents.png" alt-text="Screenshot of Microsoft Sentinel incidents." lightbox="../../media/xdr/microsoft-sentinel-incidents.png":::
security	Fileless Threats	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/intelligence/fileless-threats.md	Having described the broad categories, we can now dig into the details and provi CPU-based (Type I): Modern CPUs are complex and may include subsystems running firmware for management purposes. Such firmware may be vulnerable to hijacking and allow the execution of malicious code that would operate from within the CPU. In December 2017, two researchers reported a vulnerability that can allow attackers to execute code inside the [Management Engine (ME)](https://en.wikipedia.org/wiki/Intel_Management_Engine) present in any modern CPU from Intel. Meanwhile, the attacker group PLATINUM has been observed to have the capability to use Intel's [Active Management Technology (AMT)](https://en.wikipedia.org/wiki/Intel_Active_Management_Technology) to perform [invisible network communications](https://cloudblogs.microsoft.com/microsoftsecure/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/), bypassing the installed operating system. ME and AMT are essentially autonomous micro-computers that live inside the CPU and that operate at a very low level. Because these technologies' purpose is to provide remote manageability, they have direct access to hardware, are independent of the operating system, and can run even if the computer is turned off. -Besides being vulnerable at the firmware level, CPUs could be manufactured with backdoors inserted directly in the hardware circuitry. This attack has been [researched and proved possible](https://www.emsec.rub.de/media/crypto/veroeffentlichungen/2015/03/19/beckerStealthyExtended.pdf) in the past. It has been reported that certain models of x86 processors contain a secondary embedded RISC-like CPU core that can [effectively provide a backdoor](https://www.theregister.co.uk/2018/08/10/via_c3_x86_processor_backdoor/) through which regular applications can gain privileged execution. +Besides being vulnerable at the firmware level, CPUs could be manufactured with backdoors inserted directly in the hardware circuitry. This attack has been [researched and proved possible](https://www.microsoft.com/en-us/security/blog/2018/09/27/out-of-sight-but-not-invisible-defeating-fileless-malware-with-behavior-monitoring-amsi-and-next-gen-av/) in the past. It has been reported that certain models of x86 processors contain a secondary embedded RISC-like CPU core that can [effectively provide a backdoor](https://www.theregister.co.uk/2018/08/10/via_c3_x86_processor_backdoor/) through which regular applications can gain privileged execution. USB-based (Type I): USB devices of all kinds can be reprogrammed with malicious firmware capable of interacting with the operating system in nefarious ways. For example, the [BadUSB technique](https://arstechnica.com/information-technology/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/) allows a reprogrammed USB stick to act as a keyboard that sends commands to machines via keystrokes, or as a network card that can redirect traffic at will.
security	Virus Initiative Criteria	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/intelligence/virus-initiative-criteria.md	To qualify for the MVI program, your organization must meet all the following re \|ICSA Labs\|Endpoint Anti-Malware Detection </br> <https://www.icsalabs.com/technology-program/anti-virus/criteria>\|PASS/Certified\| \|SKD Labs\|Certification Requirements Product: Anti-virus or Antimalware </br> <http://www.skdlabs.com/html/english/> </br> <http://www.skdlabs.com/cert/>\|SKD Labs Star Check Certification Requirements Pass >= 98.5% with On Demand, On Access and Total Detection tests\| \|VB 100\|VB100 Certification Test V1.1 </br> <https://www.virusbulletin.com/testing/vb100/vb100-methodology/vb100-methodology-ver1-1/>\|VB100 Certification\| -\|West Coast Labs\|Checkmark Certified </br> <http://www.checkmarkcertified.com/sme/>\|"A" Rating on Product Security Performance\| +\|West Coast Labs\|Checkmark Certified </br> <http://www.checkmarkcertified.com/>\|"A" Rating on Product Security Performance\| \|SE Labs\|Protection, Small Business or Enterprise EP Protection Test </br> <https://selabs.uk/en/reports/consumers/>\|Protection A rating or Small Business EP A rating or Enterprise EP Protection A rating \| ## Apply now
security	Anti Malware Protection About	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-malware-protection-about.md	description: Admins can learn about anti-malware protection and anti-malware pol Previously updated : 06/09/2023 Last updated : 8/22/2023 appliesto: - Γ£à <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> - Γ£à <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> There are certain types of files that you really shouldn't send via email (for e <sup>\</sup> You can enter any text value in the Defender portal or using the _FileTypes_ parameter in the [New-MalwareFilterPolicy](/powershell/module/exchange/new-malwarefilterpolicy) or [Set-MalwareFilterPolicy](/powershell/module/exchange/set-malwarefilterpolicy) cmdlets in Exchange Online PowerShell. -The common attachments filter uses best effort true-typing to detect the file type regardless of the filename extension. If true-typing fails or isn't supported for the specified file type, then simple extension matching is used. - When files are detected by the common attachments filter, you can choose to Reject the message with a non-delivery report (NDR)* or Quarantine the message. +#### True type matching in the common attachments filter + +The common attachments filter uses best effort true type matching to detect the file type, regardless of the filename extension. True type matching uses file characteristics to determine the real file type (for example, leading and trailing bytes in the file). For example, if an `exe` file is renamed with a `txt` filename extension, the common attachments filter detects the file as an `exe` file. + +True type matching in the common attachments filter supports the following file types: + +`7zip, ace, adoc, ani, arc, arj, asf, asice, avi, bmp, bz, bz2, cab, cda, chm, deb, dex, dll, dmg, doc, docm, docx, dot, dotm, dotx, dwg, eml, eps, epub, excelml, exe, fluid, gif, gzip, heic, heif, html, hyper, icon, ics, infopathml, jar, javabytecode, jnlp, jpeg, json,lib, lnk, lzh, lzma, macho, mhtml, mp3, mp4, mpeg, mpp, msaccess, mscompress, msg, msp, musx, nws, obd, obj, obt, odbcexcel, odc, odf, odg, odi, odm, odp, ods, odt, one, otc, otf, otg, oth, oti, otp, ots, ott, pal, pcx, pdf, pfb, pfile, pif, png, pointpub, pot, potm, potx, powerpointml, ppam, pps, ppsm, ppsx, ppt, pptm, pptx, ps, pub, qcp, quicktime, rar, rar4, riff, rmi, rpm, rpmsg, rtf, smime, swf,tar, tiff, tlb, tnef, ttf, txt, vcf, vcs, vdw, vdx, vsd, vsdm, vsdx, vss, vssm, vssx, vst, vstm, vstx, vsx, vtt, vtx, wav, webp, whiteboard, wmf, woff, woff2, word2, wordml, xar, xlam, xlb, xlc, xls, xlsb, xlsm, xlsx, xlt, xltm, xltx, xml, xps, xz, z, zip, zoo` + +If true type matching fails or isn't supported for the file type, then simple extension matching is used. + ### Zero-hour auto purge (ZAP) in anti-malware policies ZAP for malware quarantines messages that are found to contain malware _after_ they've been delivered to Exchange Online mailboxes. By default, ZAP for malware is turned on, and we recommend that you leave it on. For more information, see [Zero-hour auto purge (ZAP) for malware](zero-hour-auto-purge.md#zero-hour-auto-purge-zap-for-malware).
security	Defender For Office 365 Whats New	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/defender-for-office-365-whats-new.md	For more information on what's new with other Microsoft Defender security produc - [What's new in Microsoft Defender for Identity](/defender-for-identity/whats-new) - [What's new in Microsoft Defender for Cloud Apps](/cloud-app-security/release-notes) +## August 2023 + +- If the [User reported settings](submissions-user-reported-messages-custom-mailbox.md) in the organization send user reported messages (email and [Microsoft Teams](submissions-teams.md)) to Microsoft (exclusively or in addition to the reporting mailbox), we now do the same checks as when admins submit messages to Microsoft for analysis from the Submissions page. + ## July 2023 - Use anti-phishing policies to control what happens to messages where the sender fails explicit [DMARC](email-authentication-dmarc-configure.md) checks and the DMARC policy is set to `p=quarantine` or `p=reject`. For more information, see [Spoof protection and sender DMARC policies](anti-phishing-policies-about.md#spoof-protection-and-sender-dmarc-policies).
security	Protection Stack Microsoft Defender For Office365	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/protection-stack-microsoft-defender-for-office365.md	f1.keywords: Previously updated : 6/19/2023 Last updated : 8/22/2023 audience: ITPro In this phase the filtering stack begins to handle the specific contents of the 2. Microsoft Defender Antivirus and a third-party Antivirus engine are used to detect all known malware in attachments. -3. The anti-virus (AV) engines are also used to true-type supported attachment types, which allows Type blocking to correctly block file types specified by admins. +3. The anti-virus (AV) engines use true type matching to detect the file type, regardless of the filename extension (for example, `exe` files renamed to `txt` are detected as `exe` files). This capability allows Type blocking (also known as the common attachment filter) to correctly block file types specified by admins. For the list of supported file types, see [True type matching in the common attachments filter](anti-malware-protection-about.md#true-type-matching-in-the-common-attachments-filter). 4. Whenever Microsoft Defender for Office 365 detects a malicious attachment, the file's hash, and a hash of its active content, are added to Exchange Online Protection (EOP) reputation. Attachment reputation blocking blocks that file across all Office 365, and on endpoints, through MSAV cloud calls.
security	Quarantine About	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/quarantine-about.md	description: Admins can learn about quarantine in Exchange Online Protection (EOP) that holds potentially dangerous or unwanted messages. Previously updated : 8/4/2023 Last updated : 8/30/2023 appliesto: - Γ£à <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> - Γ£à <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> How long quarantined messages or files are held in quarantine before they expire \|Quarantine reason\|Default retention period\|Customizable?\|Comments\| \|\|\|::\|\| -\|Messages quarantined by anti-spam policies: spam, high confidence spam, phishing, high confidence phishing, or bulk.\|15 days: <ul><li>In the default anti-spam policy.</li><li>In anti-spam policies that you create in PowerShell.</li></ul> <br/> 30 days in anti-spam policies that you create in the Microsoft 365 Defender portal.\|Yes\|You can configure (lower) this value in anti-spam policies. For more information, see the Retain spam in quarantine for this many days (_QuarantineRetentionPeriod_) setting in [Configure anti-spam policies](anti-spam-policies-configure.md).\| -\|Messages quarantined by anti-phishing policies: spoof intelligence in EOP; user impersonation, domain impersonation, or mailbox intelligence in Defender for Office 365.\|30 days\|Yes\|This retention period is also controlled by the Retain spam in quarantine for this many days (_QuarantineRetentionPeriod_) setting in anti-spam policies. The retention period that's used is the value from the first matching anti-spam policy that the recipient is defined in.\| -\|Messages quarantined by anti-malware policies (malware messages).\|30 days\|No\|If you turn on the common attachments filter in anti-malware policies (in the default policy or in custom policies), file attachments in email messages to the affected recipients are treated as malware based solely on the file extension. A predefined list of mostly executable file types is used by default, but you can customize the list. For more information, see [Common attachments filter in anti-malware policies](anti-malware-protection-about.md#common-attachments-filter-in-anti-malware-policies).\| -\|Messages quarantined by mail flow rules: the action is Deliver the message to the hosted quarantine (_Quarantine_).\|30 days\|No\|\| +\|Messages quarantined by anti-spam policies as spam, high confidence spam, phishing, high confidence phishing, or bulk.\|15 days <ul><li>In the default anti-spam policy.</li><li>In anti-spam policies that you create in PowerShell.</li></ul> <br/> 30 days <ul><li>In anti-spam policies that you create in the Microsoft 365 Defender portal.</li><li>In the Standard and Strict [preset security policies](preset-security-policies.md#appendix)</li></ul>\|Yes<sup>\</sup>\|You can configure (lower) the value in the default anti-spam policy and in custom anti-spam policies. For more information, see the Retain spam in quarantine for this many days* (_QuarantineRetentionPeriod_) setting in [Configure anti-spam policies](anti-spam-policies-configure.md). <br/><br/> <sup>\</sup>You can't change the value in the Standard or Strict preset security policies.\| +\|Messages quarantined by anti-phishing policies: <ul><li>EOP: Spoof intelligence.</li><li>Defender for Office 365: User impersonation protection, domain impersonation protection, and mailbox intelligence protection.</li></ul>\|15 days or 30 days\|Yes<sup>\</sup>\|This retention period is also controlled by the Retain spam in quarantine for this many days (_QuarantineRetentionPeriod_) setting in anti-spam policies. The retention period that's used is the value from the first matching anti-spam policy that the recipient is defined in.\| +\|Messages quarantined by anti-malware policies (malware messages).\|30 days\|No\|If you turn on the common attachments filter in anti-malware policies (in the default policy or in custom policies), file attachments in email messages to the affected recipients are treated as malware based solely on the file extension using true type matching. A predefined list of mostly executable file types is used by default, but you can customize the list. For more information, see [Common attachments filter in anti-malware policies](anti-malware-protection-about.md#common-attachments-filter-in-anti-malware-policies).\| +\|Messages quarantined by mail flow rules where the action is Deliver the message to the hosted quarantine (_Quarantine_).\|30 days\|No\|\| \|Messages quarantined by Safe Attachments policies in Defender for Office 365 (malware messages).\|30 days\|No\|\| \|Files quarantined by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams (malware files).\|30 days\|No\|Files quarantined in SharePoint or OneDrive are removed fom quarantine after 30 days, but the blocked files remain in SharePoint or OneDrive in the blocked state.\| \|Messages in chats and channels quarantined by zero-hour auto protection (ZAP) for Microsoft Teams in Defender for Office 365\|30 days\|No\|
security	Submissions Admin Review User Reported Messages	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-admin-review-user-reported-messages.md	Admins can mark messages and notify users of review results only if the user [re - You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the Submissions page, use <https://security.microsoft.com/reportsubmission>. To go directly to the User reported settings page, use <https://security.microsoft.com/securitysettings/userSubmission>. +- If the [User reported settings](submissions-user-reported-messages-custom-mailbox.md) in the organization send user reported messages (email and [Microsoft Teams](submissions-teams.md)) to Microsoft (exclusively or in addition to the reporting mailbox), we do the same checks as when admins submit messages to Microsoft for analysis from the Submissions page: + - Email authentication check (email messages only): Whether email authentication passed or failed when it was delivered. + - Policy hits: Information about any policies or overrides that might have allowed or blocked the incoming email into the organization, thus overriding our filtering verdicts. + - Payload reputation/detonation: Up-to-date examination of any URLs and attachments in the message. + - Grader analysis: Review done by human graders to confirm whether or not messages are malicious. + + So, submitting or resubmitting messages to Microsoft is useful to admins only for messages that have never been submitted to Microsoft, or when you disagree with the original verdict. + - You need to be assigned permissions before you can do the procedures in this article. You have the following options: - [Email & collaboration RBAC in the Microsoft 365 Defender portal](mdo-portal-permissions.md): Membership in the Organization Management or Security Administrator role groups. - [Exchange Online RBAC](/exchange/permissions-exo/permissions-exo): Membership in the Organization Management role group.
security	Submissions Admin	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-admin.md	description: "Admins can learn how to use the Submissions page in the Microsoft 365 Defender portal to submit messages, URLs, and email attachments to Microsoft for analysis. Reasons for submission include: legitimate messages that were blocked, suspicious messages that were allowed, suspected phishing email, spam, malware, and other potentially harmful messages." Previously updated : 7/7/2023 Last updated : 8/7/2023 appliesto: - Γ£à <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> - Γ£à <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> In Microsoft 365 organizations with Exchange Online mailboxes, admins can use th After an admin submits the message from the User reported tab, an entry is also created on the corresponding tab on the Submissions page (for example, the Emails tab). These types of admin submissions are described in the [Admin options for user reported messages](#admin-options-for-user-reported-messages) section. -When admins submit messages for analysis, Microsoft does the following checks: +When admins submit messages to Microsoft for analysis, we do the following checks: - Email authentication check (email messages only): Whether email authentication passed or failed when it was delivered. - Policy hits: Information about any policies or overrides that might have allowed or blocked the incoming email into the organization, thus overriding our filtering verdicts. When admins submit messages for analysis, Microsoft does the following checks: - Grader analysis: Review done by human graders to confirm whether or not messages are malicious. > [!IMPORTANT] -> In U.S. Government organizations (Microsoft 365 GCC, GCC High, and DoD), admins can submit email messages to Microsoft for analysis, but the messages are analyzed for email authentication and policy checks only. Payload reputation, detonation, and grader analysis aren't done for compliance reasons (data isn't allowed to leave the organization boundary). +> In U.S. Government organizations (Microsoft 365 GCC, GCC High, and DoD), admins can submit email messages to Microsoft for analysis, but the messages are analyzed for email authentication and policy hits only. Payload reputation, detonation, and grader analysis aren't done for compliance reasons (data isn't allowed to leave the organization boundary). Watch this short video to learn how to use admin submissions in Microsoft Defender for Office 365 to submit messages to Microsoft for evaluation. For other ways that admins can report messages to Microsoft in the Defender - Same submissions in a 24 hour period: Three submissions - Same submissions in a 15-minute period: One submission +- If the [User reported settings](submissions-user-reported-messages-custom-mailbox.md) in the organization send user reported messages (email and [Microsoft Teams](submissions-teams.md)) to Microsoft (exclusively or in addition to the reporting mailbox), we do the same checks as when admins submit messages to Microsoft for analysis from the Submissions page. So, submitting or resubmitting messages to Microsoft is useful to admins only for messages that have never been submitted to Microsoft, or when you disagree with the original verdict. + - A Files tab is available on the Submissions page only in organizations with Microsoft 365 Defender or Microsoft Defender for Endpoint Plan 2. For information and instructions to submit files from the Files tab, see [Submit files in Microsoft Defender for Endpoint](../defender-endpoint/admin-submissions-mde.md). ## Admin-originated submissions
security	Submissions Outlook Report Messages	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-outlook-report-messages.md	description: Learn how to report phishing and suspicious emails in Outlook using search.appverid: met150 Previously updated : 6/20/2023 Last updated : 8/7/2023 appliesto: - Γ£à <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> - Γ£à <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> To review messages that users have reported to Microsoft, admins have these opti - Use the User reported tab on the Submissions page in the Microsoft 365 Defender portal at <https://security.microsoft.com/reportsubmission>. For more information, see [View user reported messages to Microsoft](submissions-admin.md#view-user-reported-messages-to-microsoft). + > [!NOTE] + > If the [User reported settings](submissions-user-reported-messages-custom-mailbox.md) in the organization send user reported messages (email and [Microsoft Teams](submissions-teams.md)) to Microsoft (exclusively or in addition to the reporting mailbox), we do the same checks as when admins submit messages to Microsoft for analysis from the Submissions page. So, submitting or resubmitting messages to Microsoft is useful to admins only for messages that have never been submitted to Microsoft, or when you disagree with the original verdict. + - Create a mail flow rule (also known as a transport rule) to send copies of reported messages to a recipient for review. For instructions, see [Use mail flow rules to see what users are reporting to Microsoft](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-see-what-users-are-reporting-to-microsoft). ## More information
security	Submissions Report Messages Files To Microsoft	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-report-messages-files-to-microsoft.md	f1.keywords: Previously updated : 6/20/2023 Last updated : 8/7/2023 audience: ITPro ms.localizationpriority: medium Watch this video that shows more information about the unified submissions exper > When you report a message to Microsoft, everything associated with the message is copied and included in the continual algorithm reviews. This copy includes email content, email headers, any attachments, and related data about email routing. > > Microsoft treats your feedback as your organization's permission to analyze all the information to fine tune the message hygiene algorithms. Your message is held in secured and audited data centers in the USA. The submission is deleted as soon as it's no longer required. Microsoft personnel might read your submitted messages and attachments, which is normally not permitted for email in Microsoft 365. However, your email is still treated as confidential between you and Microsoft, and your email or attachments isn't shared with any other party as part of the review process. +> +> For information about reporting messages in Microsoft Teams in Defender for Office 365 Plan 2, see [User reported message settings in Microsoft Teams](submissions-teams.md). \|Method\|Submission type\|Comments\| \|\|\|\|
security	Submissions Teams	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-teams.md	description: "Admins can configure whether users can report malicious message in Microsoft Teams." Previously updated : 7/7/2023 Last updated : 8/7/2023 appliesto: - Γ£à <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> - Γ£à <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> Users can report messages in Teams from internal chats, channels and meeting > [!NOTE] > User reporting of messages in Teams is not supported in U.S. Government organizations (Microsoft 365 GCC, GCC High, and DoD). +> +> For information about user reporting of email messages, see [Report suspicious email messages to Microsoft](submissions-report-messages-files-to-microsoft.md). ## User reporting settings for Teams messages
security	Submissions User Reported Messages Custom Mailbox	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-user-reported-messages-custom-mailbox.md	description: "Admins can configure where user reported messages go for analysis: to an internal reporting mailbox, to Microsoft, or both. Other settings complete the reporting experience for users when they report good messages, spam, or phishing messages from Outlook." Previously updated : 7/6/2023 Last updated : 8/7/2023 appliesto: - Γ£à <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> - Γ£à <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> Delivering user reported messages to a reporting mailbox instead of directly to > [!NOTE] > The _ReportJunkEmailEnabled_ parameter on the [Set-OwaMailboxPolicy](/powershell/module/exchange/set-owamailboxpolicy) cmdlet no longer controls whether user message reporting is enabled or disabled. User reporting of messages is now controlled on the User reported settings page at <https://security.microsoft.com/securitysettings/userSubmission> as described in this article. > -> For information about user reported message settings in Microsoft Teams, see [User reported message settings in Microsoft Teams](submissions-teams.md). +> For information about user reported message settings in Microsoft Teams in Defender for Office 365 Plan 2, see [User reported message settings in Microsoft Teams](submissions-teams.md). +> +> If the [User reported settings](submissions-user-reported-messages-custom-mailbox.md) in the organization send user reported messages (email and [Microsoft Teams](submissions-teams.md)) to Microsoft (exclusively or in addition to the reporting mailbox), we do the same checks as when admins submit messages to Microsoft for analysis from the Submissions page. So, submitting or resubmitting messages to Microsoft is useful to admins only for messages that have never been submitted to Microsoft, or when you disagree with the original verdict. ## Configuration requirements for the reporting mailbox
security	Submissions Users Report Message Add In Configure	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-users-report-message-add-in-configure.md	audience: Admin Previously updated : 6/20/2023 Last updated : 8/7/2023 ms.localizationpriority: medium search.appverid: - MET150 After the add-in is installed and enabled, users see the following icons based o > - Monitor reported messages in Outlook is selected. > - Use the built-in "Report" button in Outlook is selected. +- If the [User reported settings](submissions-user-reported-messages-custom-mailbox.md) in the organization send user reported messages (email and [Microsoft Teams](submissions-teams.md)) to Microsoft (exclusively or in addition to the reporting mailbox), we do the same checks as when admins submit messages to Microsoft for analysis from the Submissions page: + - Email authentication check (email messages only): Whether email authentication passed or failed when it was delivered. + - Policy hits: Information about any policies or overrides that might have allowed or blocked the incoming email into the organization, thus overriding our filtering verdicts. + - Payload reputation/detonation: Up-to-date examination of any URLs and attachments in the message. + - Grader analysis: Review done by human graders to confirm whether or not messages are malicious. + + So, submitting or resubmitting messages to Microsoft is useful to admins only for messages that have never been submitted to Microsoft, or when you disagree with the original verdict. + - Organizations that use URL filtering or a third-party security solution (for example, a proxy and/or firewall) must be able to reach the following URLs using the HTTPS protocol: - `ipagave.azurewebsites.net` - `outlook.office.com`
solutions	Apps License Overview	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/apps-license-overview.md	You can freely add and deploy most apps provided within [Microsoft Intune admin ## Microsoft app licenses included with Intune -Intune includes several Microsoft apps based on the Microsoft license that you use for Intune. To learn more about the different Microsoft enterprise license available that includes Intune, see [Microsoft Intune licensing](/mem/intune/fundamentals/licenses). To compare the different Microsoft apps that are available with Microsoft 365, see the [licensing options available with Microsoft 365](/microsoft-365/compare-microsoft-365-enterprise-plans). To see all the options for each plan (including the available Microsoft apps), download the full [Microsoft subscription comparison table](https://go.microsoft.com/fwlink/?linkid=2139145) and locate the plans that include Microsoft Intune. +Intune includes several Microsoft apps based on the Microsoft license that you use for Intune. To learn more about the different Microsoft enterprise license available that includes Intune, see [Microsoft Intune licensing](/mem/intune/fundamentals/licenses). To compare the different Microsoft apps that are available with Microsoft 365, see the [licensing options available with Microsoft 365](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans). To see all the options for each plan (including the available Microsoft apps), download the full [Microsoft subscription comparison table](https://go.microsoft.com/fwlink/?linkid=2139145) and locate the plans that include Microsoft Intune. ### App functionality included with Microsoft 365 E5 license
solutions	Empower People To Work Remotely Teams Productivity Apps	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-teams-productivity-apps.md	To be productive, people need to communicate and collaborate with one another. T ## Keep people connected with Microsoft Teams -Teams with Microsoft Teams allows your organization to chat, meet, call, and collaborate all in one place. Millions of people get their work done with teams every day because it brings together everything you need to work on-site or remotely into a hub for teamwork. +Teams with Microsoft Teams allows your organization to chat, meet, call, and collaborate all in one place. Millions of people get their work done with teams every day because it brings together everything you need to work on-site or remotely into a hub for teamwork. -For detailed guidance, see [Support remote workers using Microsoft Teams](/microsoftteams/support-remote-work-with-teams). +For detailed guidance, see [Support remote workers using Microsoft Teams](/microsoftteams/support-remote-work-with-teams). -Watch the [Enabling hybrid work with Microsoft Teams webcasts](https://resources.techcommunity.microsoft.com/enabling-hybrid-work/) for guidance and demos on using Teams for hybrid work. +Read [Enabling hybrid work with Microsoft 365 and collaborative apps](https://www.microsoft.com/en-us/microsoft-365/blog/2022/07/19/from-enabling-hybrid-work-to-creating-collaborative-experiences-heres-whats-new-in-microsoft-365/) for guidance and demos on using Teams for hybrid work. ### Chat and conversations For more information, see the [Deployment guide for Microsoft 365 Apps](/deployo ## Admin technical resources for productivity apps and services - [Support remote workers using Microsoft Teams](/microsoftteams/support-remote-work-with-teams)-- [Enabling hybrid work with Microsoft Teams webcasts](https://resources.techcommunity.microsoft.com/enabling-hybrid-work/) - [Teams Customer Success Kit download](https://www.microsoft.com/download/details.aspx?id=54244) - [Tools for driving Teams adoption](/microsoftteams/adopt-tools-and-downloads) - [Create a change management strategy for Microsoft Teams](/MicrosoftTeams/change-management-strategy)
syntex	Difference Between Document Understanding And Form Processing Model	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/difference-between-document-understanding-and-form-processing-model.md	Use the following table to see differences in custom models to help identify the \| Integrate with managed metadata \| Yes, by training entity extractor referencing a configured managed metadata field. \| No \| No \| \| Compliance feature integration with Microsoft Purview Information Protection \| Set published retention labels.<br>Set published sensitivity labels. \| Set retention labels is coming. <br>Set sensitivity labels is coming. \| Set published retention labels. <br>Set sensitivity labels is coming. \| \| Supported regions\| Available in all regions. \| Relies on Power Platform. For information about global availability for Power Platform and AI Builder, see [Power Platform availability](https://dynamics.microsoft.com/geographic-availability/). \| Relies on Power Platform. For information about global availability for Power Platform and AI Builder, see [Power Platform availability](https://dynamics.microsoft.com/geographic-availability/). \| -\| Transactional cost \| Not applicable \| Uses AI Builder credits.<br>3,500 credits are included for each Syntex license per month.<br>1 million credits will allow processing of 10,000 file pages. \| Uses AI Builder credits.<br>3,500 credits are included for each Syntex license per month.<br>1 million credits will allow processing of 10,000 file pages. \| +\| Transactional cost \| Not applicable \| For per-user licensing, uses AI Builder credits. 3,500 credits are included for each Syntex license per month. One million credits will allow processing of 10,000 file pages.<br>For pay-as-you-go licensing, not applicable. \| For per-user licensing, uses AI Builder credits. 3,500 credits are included for each Syntex license per month. One million credits will allow processing of 10,000 file pages.<br>For pay-as-you-go licensing, not applicable. \| \| Capacity \| No capacity restrictions. \| Uses the default Power Platform environment (custom environments with Dataverse database supported). \| Uses the default Power Platform environment (custom environments with Dataverse database supported). \| \| Supported languages\| Models work on all Latin alphabet languages. In addition to English: German, Swedish, French, Spanish, Italian, and Portuguese. \| Current language support is for English. \| Language support for [more than 100 languages](/ai-builder/form-processing-model-requirements#languages-supported). \|
syntex	Image Tagging Overview	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/image-tagging-overview.md	Title: Overview of image tagging in Microsoft Syntex + Title: Overview of enhanced image tagging in Microsoft Syntex - enabler-strategic - m365initiative-syntex ms.localizationpriority: medium -description: Learn about image tagging in Microsoft Syntex. +description: Learn about enhanced image tagging in Microsoft Syntex. -# Overview of image tagging in Microsoft Syntex +# Overview of enhanced image tagging in Microsoft Syntex Microsoft Syntex makes it easier to find and manage images in SharePoint document libraries. It does this process by automatically tagging images with descriptive keywords using AI. These keywords are stored in a managed metadata column (the Image Tags column), which makes it easier to search, sort, filter, and manage the images.
syntex	Image Tagging Setup	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/image-tagging-setup.md	Title: Set up and manage image tagging in Microsoft Syntex + Title: Set up and manage enhanced image tagging in Microsoft Syntex - enabler-strategic - m365initiative-syntex ms.localizationpriority: medium -description: Learn how to set and configure image tagging in Microsoft Syntex. +description: Learn how to set and configure enhanced image tagging in Microsoft Syntex. -# Set up and manage image tagging in Microsoft Syntex +# Set up and manage enhanced image tagging in Microsoft Syntex The image tagging service for Microsoft Syntex is set up in the Microsoft 365 admin center.
syntex	Image Tagging	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/image-tagging.md	Title: Find and manage images using image tagging in Microsoft Syntex + Title: Find and manage images using enhanced image tagging in Microsoft Syntex - enabler-strategic - m365initiative-syntex ms.localizationpriority: medium -description: Learn how to use image tagging to search, sort, filter, and manage images in Microsoft Syntex. +description: Learn how to use enhacnced image tagging to search, sort, filter, and manage images in Microsoft Syntex. -# Find and manage images using image tagging in Microsoft Syntex +# Find and manage images using enhanced image tagging in Microsoft Syntex Before you can use image tagging, you need to enable it in a document library. There are two methods you can use to do this: