| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| includes | Defender Content Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/defender/includes/defender-content-updates.md | -## Week of July 18, 2022 +## Week of August 01, 2022 | Published On |Topic title | Change | |||--|-| 7/18/2022 | [Defender Threat Intelligence](/defender/threat-intelligence/index) | added | +| 8/1/2022 | [Microsoft Defender Threat Intelligence (Defender TI) Analyst Insights](/defender/threat-intelligence/analyst-insights) | added | +| 8/1/2022 | [Microsoft Defender Threat Intelligence (Defender TI) Data Sets](/defender/threat-intelligence/data-sets) | added | +| 8/1/2022 | [Tutorial: Gathering Threat Intelligence and Infrastructure Chaining using Microsoft Defender Threat Intelligence (Defender TI)](/defender/threat-intelligence/gathering-threat-intelligence-and-infrastructure-chaining) | added | +| 8/1/2022 | [Microsoft Defender Threat Intelligence (Defender TI): Infrastructure Chaining](/defender/threat-intelligence/infrastructure-chaining) | added | +| 8/1/2022 | [Quickstart: Accessing the Microsoft Defender Threat Intelligence (Defender TI) Portal](/defender/threat-intelligence/learn-how-to-access-microsoft-defender-threat-intelligence-and-make-customizations-in-your-portal) | added | +| 8/1/2022 | [Microsoft Defender Threat Intelligence (Defender TI) Reputation Scoring](/defender/threat-intelligence/reputation-scoring) | added | +| 8/1/2022 | [Searching & pivoting with Microsoft Defender Threat Intelligence (Defender TI)](/defender/threat-intelligence/searching-and-pivoting) | added | +| 8/1/2022 | [Sorting, filtering, and downloading data using Microsoft Defender Threat Intelligence (Defender TI)](/defender/threat-intelligence/sorting-filtering-and-downloading-data) | added | +| 8/1/2022 | [Using Projects with Microsoft Defender Threat Intelligence (MDTI)](/defender/threat-intelligence/using-projects) | added | +| 8/1/2022 | [Using Tags in Microsoft Defender Threat Intelligence (Defender TI)](/defender/threat-intelligence/using-tags) | added | +| 8/1/2022 | [What is Microsoft Defender Threat Intelligence (Defender TI)?](/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti) | added | +| 8/2/2022 | Defender Threat Intelligence | removed | +| 8/2/2022 | [What is Microsoft Defender Threat Intelligence (Defender TI)?](/defender/threat-intelligence/index) | modified | +| 8/2/2022 | What is Microsoft Defender Threat Intelligence (Defender TI)? | removed | +| 8/3/2022 | [Tutorial: Gathering vulnerability intelligence](/defender/threat-intelligence/gathering-vulnerability-intelligence) | added | -## Week of June 20, 2022 +## Week of July 18, 2022 | Published On |Topic title | Change | |||--|-| 6/23/2022 | [Defender Threat Intelligence](/defender-threat-intelligence/index) | modified | +| 7/18/2022 | [Defender Threat Intelligence](/defender/threat-intelligence/index) | added | |
| threat-intelligence | Gathering Vulnerability Intelligence | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/defender/threat-intelligence/gathering-vulnerability-intelligence.md | Microsoft will share online resources (e.g., IP addresses, domain names) that sh We ask that users use their best judgment and minimize unnecessary risk while interacting with malicious systems when performing the tutorial below. Please note that Microsoft has worked to minimize risk by defanging malicious IP addresses, hosts, and domains. ## Before You Begin+ As the disclaimer states above, suspicious, and malicious indicators have been defanged for your safety. Please remove any brackets from IPs, domains, and hosts when searching in Defender TI. Do not search these indicators directly in your browser. ## Open Defender TIΓÇÖs Threat Intelligence Home Page As the disclaimer states above, suspicious, and malicious indicators have been d 8. Take note of the following artifacts from steps 5 and 7: - | | | - | -- | -- | + | | | + | | | | Whois Address | 1928 E. Highland Ave. Ste F104 PMB# 255 | | Whois City | phoenix | | Whois State | az | |
| threat-intelligence | Sorting Filtering And Downloading Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/defender/threat-intelligence/sorting-filtering-and-downloading-data.md | Data can be downloaded within the following sections: The following headers are exported as a result of downloading Resolutions, DNS, and reverse DNS data: -| | | +| | | |-|-| | **Resolve** | A record associated with the domain searched (resolving IP Address) or domain that has resolved to an IP address when an IP address is searched | | **Location** | Country the IP address is hosted in | The following headers are exported as a result of downloading Resolutions, DNS, The following headers are exported as a result of downloading Subdomains data: -| | | +| | | |-|-| | **hostname** | Subdomain of the domain searched | | **tags** | Custom or system tags associated with the artifact | The following headers are exported as a result of downloading Trackers data: -| | | +| | | |-|-| | **hostname** | Hostname that observed or is currently observing the tracker | | **firstSeen** | Date / Time when Microsoft first observed the hostname was using the tracker (format: mm/dd/yyyy hh:mm) | The following headers are exported as a result of downloading Trackers data: The following headers are exported as a result of downloading Components data: -| | | +| | | |-|-| | **hostname** | Hostname that observed or is currently observing the component | | **firstSeen** | Date / Time when Microsoft first observed the hostname was using the tracker (format: mm/dd/yyyy hh:mm | The following headers are exported as a result of downloading Components data: The following headers are exported as a result of downloading Host Pairs data: -| | | +| | | |-|-| | **parentHostname** | The hostname that is reaching out to the child hostname | | **childHostname** | The hostname that is feeding assets they host to the parent hostname. | The following headers are exported as a result of downloading Host Pairs data: The following headers are exported as a result of downloading Hashes data: -| | | +| | | |--|-| | **source** | The source who observed the MD5 hash sample | | **sample** | The MD5 hash | The following headers are exported as a result of downloading Hashes data: The following headers are exported as a result of downloading Cookies data: -| | | +| | | |-|-| | **hostname** | Hostname that observed the Cookie name | | **firstSeen** | When the Cookie name was first observed to the hostname originating from the Cookie Domain (format: mm/dd/yyyy hh:mm) | The following headers are exported as a result of downloading Cookies data: The following headers are exported as a result of downloading projects lists for my, team, and shared projects: -| | | +| | | |-|-| | **name** | Name of project | | **artifacts (count)** | Count of artifacts within the project | The following headers are exported as a result of downloading projects lists for The following headers are exported as a result of downloading project details (artifacts) from a project: -| | | +| | | |-|-| | **artifact** | Artifact value (e.g. IP address, domain, host, WHOIS value, certificate SHA-1, etc.) | | **type** | Type of artifact (e.g. IP, domain, host, WHOIS Organization, WHOIS Phone, Certificate SHA-1, etc.) | The following headers are exported as a result of downloading project details (a The following headers are exported as a result of downloading threat intelligence public or riskiq indicators: -| | | +| | | |-|-| | **type** | Type of indicator (e.g. ip, certificate, domain, hash_sha256) | | **value** | Value of the indicator (e.g. IP address, domain, hostname) | The following headers are exported as a result of downloading threat intelligenc ## Next steps -For more information, see [Data sets](data-sets.md). +For more information, see [Data sets](data-sets.md). |
| admin | Ownerless Groups Teams | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/create-groups/ownerless-groups-teams.md | To set an ownerless group or team policy 1. Type the number of active members that you want to notify and select the number of weeks to send the notification. (The notification list is created during the first notification and does not change.) Select **Next**. -1. On the *Who is this email coming from* page, select a sender for the email, and then select **Next**. +1. On the *Who is this email coming from* page, select a sender for the email, and then select **Next**. Note that shared mailboxes are not supported. The sender must be either a user mailbox or a group mailbox. 1. On the *Subject and message* page, customize the email and optionally include a **policy guideline URL**, and then select **Next**. |
| admin | M365 Feature Descriptions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/m365-feature-descriptions.md | Microsoft Office 365 provides the following help and training resources. Communi **Languages for Troubleshooting:** Chinese-Simplified, Chinese-Traditional, French, German, Italian, Japanese, Korean, Polish, Portuguese-Brazil, Russian, and Spanish. -# [**Domains, networks, partners, S&C, and SLA**](#tab/Domains) +# [**Domains, networking and partners**](#tab/Domains) ## Domains As an authorized Microsoft partner, Microsoft Office 365 offers you an opportuni **Microsoft partner network:** The Microsoft Partner Network is committed to serving the needs of our partners. To join the network, and to see how Microsoft serves its partners, see [Microsoft Partner Network](https://go.microsoft.com/fwlink/?LinkID=272021&clcid=0x409). +# [**Privacy, security, rights, and SLA**](#tab/Privacy) + ## Privacy, security, and transparency Microsoft values the partnerships we have with our customers and places great emphasis on protecting the privacy and security of customer data. For more information, see the [Microsoft Trust Center](https://go.microsoft.com/fwlink/?LinkID=717951&clcid=0x409). The information in this article applies to worldwide versions of Office 365. If you're using a national cloud instance of Office 365, including Office 365 U.S. Government, and Office 365 operated by 21Vianet, see [**Microsoft National Clouds**](https://go.microsoft.com/fwlink/?linkid=841582). |
| admin | Manage Deployment Of Add Ins | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/manage-deployment-of-add-ins.md | Depending on the size of the target audience, you can add or remove roll-out ste Before you begin, see [Determine if Centralized Deployment of add-ins works for your organization](centralized-deployment-of-add-ins.md). -1. In the admin center, go to the **Settings** \> **Add-ins** page. If you don't see the **Add-in** Page, go to the **Settings** \> **Integrated apps** \> **Add-ins** page. +1. In the admin center, go to the **Settings** \> **Integrated apps** \> **Add-ins** page. 2. Select **Deploy Add-in** at the top of the page, and then select **Next**. |
| admin | Experience Insights Dashboard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/misc/experience-insights-dashboard.md | + + Title: "Microsoft 365 Experience insights dashboard" ++++audience: Admin +++ms.localizationpriority: medium ++description: "Get a periodic report of how people in your organization are using Microsoft 365 services and drill into each chart for more insights." +++# Microsoft 365 Experience insights dashboard ++The Experience insights (preview) dashboard shows you data across usage and sentiment to give you a fuller view of your organization's experience with Microsoft 365. This information and data on the dashboard will help you better understand and improve your users experience with Microsoft 365. The dashboard shows you data across usage and user sentiment, and helps give you a fuller picture of your user's overall experience. You can drill down into specific information such as feature usage for certain apps, exact feedback and Net Promoter Score (NPS) comments, and top help articles viewed by users in your organization. This info can help you identify opportunities to improve userΓÇÖs Microsoft 365 products and app experiences in your organization. ++<!--To learn more about adoption and training for users in your organization, see [Experience insights help article report](experience-insights-help-articles.md). --> ++## How to get to the Experience insights dashboard ++There are a couple of ways to get the Experience insights dashboard page. If youΓÇÖre a member of the global admin or global reader roles, when you log in to the Microsoft 365 admin center, youΓÇÖll see a one-time prompt to go to the Experience insights (preview) dashboard. You can access it at any time by selecting Experience insights (preview) from the admin home page. +++If youΓÇÖre a member of the reports reader role, once you sign into the admin center, youΓÇÖll automatically go to the Experience insights (preview) dashboard page. You can switch back to the admin center Dashboard view by selecting that option in the top right. +++To learn more, see [About admin roles](../add-users/about-admin-roles.md) andΓÇ»[Assign admin roles](../add-users/assign-admin-roles.md). ++## Apps and services data ++The **Apps and services** data section shows you a unified view across usage and sentiment in your organization to give you an at-a-glance understanding of your users' experience with Microsoft 365. Select an app or service to get additional details, such as comments submitted through feedback and NPS surveys, or the top Microsoft 365 help articles your users viewed. You can also favorite the apps or services in the list so that you can more easily view them. ++### Apps and services chart information ++The chart information gives you insight into the apps and services that you want to track data on. Select an app or service to dig deeper into usage, product feedback, net promoter score and help content data. +++**Active users** tells you the total count of unique users who performed at least one intentional action, like opening a file, in the app over the selected time period. Use this data to make sure you are hitting your adoption goals. [Learn more](../activity-reports/active-users-ww.md) ++**Product usage** is the percentage of people who are actively using the products that are enabled for them to use. Use this data to make decisions on where to optimize product assignments. ++**In-product feedback** Is the total number of feedback response from within the app or service that were initiated and submitted by your users. Use this data to gauge the success and satisfaction people have with the apps. [Learn more](feedback-user-control.md) ++**NPS survey response volume** is the total number of responses to the Net Promoter Score (NPS) survey. By default, Microsoft sends the survey to 5% of your users and asks ΓÇ£Would you recommend this product?ΓÇ¥ Use this data to gauge user satisfaction and to see what people are saying about the app. [Learn more](../manage/manage-feedback-product-insights.md) ++**Help article views** is the total number of views of Microsoft help articles and training videos about the app. Use this data to find topics of interest and share the suggested training with your users. [Learn more](experience-insights-help-articles.md) ++> [!NOTE] +> You can filter the chart data for trends over the last 30 days, 90 days, or 180 days. ++## Products and services data ++Select a product or service to see more detailed information about product usage, user feedback, Net Promoter Score (NPS) and what help articles your users are reading. ++### Teams usage example ++For some apps and services, you can see additional information into the usage of specific features to get a better understanding of what your users are using the most. +++### Teams user feedback example ++In the user feedback section, you can see the actual comments your users submitted to help you gauge if there is a pattern that needs to be addressed. +++### Teams Net Promoter Score (NPS) example ++NPS details allow you see promoters, passives, and detractors so that you can get a pulse on the sentiment in your organization. Similar to product feedback, you can also view the specific comments your users submitted. In some cases where there is enough volume, you may also see Top topics that categorizes some of the comments into bucketed categories for easier parsing of the data. +++### Teams help article example ++For the first time, you can now see what articles your users are consuming on Support.Microsoft.com com or via the Microsoft 365 in-app help experiences. You can see the top articles for the specific app or service in your organization, how many people are viewing the app, and preview the article in-line. This can be an excellent way of identifying what your users are trying to do and where they may be struggling. Since not all users seek out help, itΓÇÖs a good indication of content that may be beneficial to a broader set of users in the organization. [Learn more](experience-insights-help-articles.md) +++## Additional resources ++<!-- :::image type="content" source="../../media/additional-resources.png" alt-text="Screenshot: Image showing additional resources you can select"::: --> ++### View your organization's Productivity Score ++Productivity Score supports the journey to digital transformation with insights about how your organization uses Microsoft 365 and the technology experiences that support it. Your organization's score reflects people and technology experience measurements and can be compared to benchmarks from organizations similar in size to yours. For more information on Productivity Score, read, [Productivity Score](../productivity/productivity-score.md). ++### Take training for adoption specialists ++In this introductory course, you'll learn the six critical elements to drive adoption of your Microsoft cloud services to deliver value to your company. This course is applicable to any size company and uses Office 365 and Microsoft Teams as the example service to create real world scenarios. ++### Join the adoption community ++Welcome to the Driving Adoption Community! Connect and discuss the latest topics and best practices in driving cloud adoption. Meet and learn from peers and Microsoft Staff and stay up to date on upcoming trainings, events and our monthly Community calls. ++### Use the Microsoft 365 adoption tools ++Use our resources to go from inspiration to execution with our productivity cloud. Get started, experiment with our services, and onboard employees at scale while being confident that you are improving the employee experience. |
| admin | Experience Insights Help Articles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/misc/experience-insights-help-articles.md | + + Title: "Experience insights help article report" ++++audience: Admin +++ms.localizationpriority: medium ++description: "Get a report of the Microsoft 365 help articles people in your organization are reading." +++# Experience insights help article report ++As the admin of a Microsoft 365 organization, you get a report of the Microsoft 365 help articles people in your organization are reading. You can use this information to see which Microsoft 365 product or service your users need the most help using and provide more resources and help. To learn more about adoption and training for users in your organization, see [Microsoft 365 Experience insights dashboard](experience-insights-dashboard.md). +++## How to get to the Experience insights dashboard ++There are a couple of ways to get the Experience insights dashboard page. If youΓÇÖre a member of the global admin or global reader roles, when you log in to the Microsoft 365 admin center, youΓÇÖll see a one-time prompt to go to the Experience insights (preview) dashboard. You can access it at any time by selecting Experience insights (preview) from the admin home page. +++If youΓÇÖre a member of the reports reader role, once you sign into the admin center, youΓÇÖll automatically go to the Experience insights (preview) dashboard page. You can switch back to the admin center Dashboard view by selecting that option in the top right. ++Select an app or service and then select **Help content**. ++## Interpret your organization's help article views ++Chart information gives you insight into the apps and services that you want to track data on. Help article views is the total number of help article page views that users in your organization have viewed in a Microsoft 365 app or on support.microsoft.com. +++> [!NOTE] +> Help article views are only shown for users who have signed in to the desktop app or have signed in to [support.microsoft.com](https://support.microsoft.com). ++|Item|Description| +|:--|:--| +|1 |Use the Help content tab to see where people need help using the app or service. | +|2 |You can filter for trends over the last 30 days, 90 days, or 180 days. | +|3 |Total number of help article page views in app or on [support.microsoft.com](https://support.microsoft.com). | +|4 |List of the top help articles related to the app or service that your end-users are reading. If an article covers multiple apps, it will be shown for each related app. | ++## Examples of help articles ++Help articles can be found in-app in the help pane or at the [Microsoft support page](https://support.microsoft.com/). ++### Help article on Microsoft support page +++### In-app help article in Microsoft Word + |
| business-premium | Index | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/index.md | ms.audience: Admin ms.localizationpriority: high Previously updated : 08/01/2022 Last updated : 08/08/2022 - M365-Campaigns - m365solution-overview The task before you is this: let Microsoft 365 Business Premium help secure your :::image type="content" source="media/sixmissions.png" alt-text="Diagram listing six missions."::: +**Fortify your environment**. (These are tasks your admin completes.) -| Mission | Description | -||| -| **Fortify your environment** | These are tasks your admin completes. | -| [**1. Sign in and set up your environment**](m365bp-setup-overview.md). | Complete the basic setup process for Microsoft 365 for your business or campaign. | -| [**2. Bump up security protection**](m365bp-security-overview.md). | Set up critical front-line security measures to prevent cyberattacks. | -| **Train your team** | These are tasks everyone does. | -| [**3. Set up unmanaged (BYOD) devices**](m365bp-protect-pcs-macs.md). | Set up all the unmanaged ("bring your own device," also referred to as BYOD) devices so they are safely part of the ecosystem. | -| [**4. Use email securely**](m365bp-protect-email-overview.md). | Know what to watch for, and take the necessary steps to protect yourself from attacks through email systems. | -| [**5. Collaborate and share securely**](m365bp-collaborate-share-securely.md). | Learn how to share files with others and collaborate more securely with Microsoft Teams, SharePoint, and OneDrive. | -| **Safeguard managed devices** | These are tasks your admin or security team does. | -| [**6. Set up and secure managed devices**](m365bp-protect-devices.md). | Enroll and secure company devices so they monitored and protected from threats. | +- [**1. Sign in and set up your environment**](m365bp-setup-overview.md). Complete the basic setup process for Microsoft 365 for your business or campaign. +- [**2. Bump up security protection**](m365bp-security-overview.md). Set up critical front-line security measures to prevent cyberattacks. ++**Train your team**. (These are tasks everyone does.) ++- [**3. Set up unmanaged (BYOD) devices**](m365bp-protect-pcs-macs.md). Set up all the unmanaged ("bring your own device," also referred to as BYOD) devices so they are safely part of the ecosystem. +- [**4. Use email securely**](m365bp-protect-email-overview.md). Know what to watch for in your email, and take the necessary steps to protect yourself from attacks. +- [**5. Collaborate and share securely**](m365bp-collaborate-share-securely.md). Learn how to share files with others and collaborate more securely with Microsoft Teams, SharePoint, and OneDrive. ++**Safeguard managed devices**. These are tasks your admin or security team does. ++- [**6. Set up and secure managed devices**](m365bp-protect-devices.md). Enroll and secure company devices so they monitored and protected from threats. Completing all six missions is the most effective way to thwart hackers, protect against ransomware, and help ensure your organizationΓÇÖs future is safeguarded with the best cybersecurity defenses. Let's get started! |
| business-premium | M365bp Conditional Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-conditional-access.md | audience: Admin ms.localizationpriority: high Previously updated : 08/05/2022 Last updated : 08/08/2022 - M365-Campaigns - m365solution-smb description: "Learn how security defaults can help protect your organization fro Microsoft 365 Business Premium was designed to help protect your company's user accounts with preconfigured security settings. These settings include enabling multi-factor authentication (MFA) for all your admins and user accounts. For most organizations, security defaults offer a good level of sign-in security. -For more information about security defaults and the policies they enforce, see [What are security defaults?](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults) +> [!TIP] +> For more information about security defaults and the policies they enforce, see [What are security defaults?](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults). This article provides information about: |
| business-premium | M365bp Increase Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-increase-protection.md | Title: "Increase threat protection for Microsoft 365 Business Premium" + Title: "Protect against malware and other threats with Microsoft 365 Business Premium" f1.keywords: - NOCSH audience: Admin ms.localizationpriority: high Previously updated : 07/19/2022 Last updated : 08/08/2022 - M365-Campaigns - m365solution-smb search.appverid: description: "Get help with increasing the level of protection in Microsoft 365 Business Premium" -# Increase threat protection for Microsoft 365 Business Premium +# Protect against malware and other cyberthreats with Microsoft 365 Business Premium In this objective, you increase your threat protection with Microsoft 365 Business Premium. It's critical to protect your business against phishing, malware, and other threats. This article includes information about: In this objective, you increase your threat protection with Microsoft 365 Busine - [Custom security policies](#create-custom-security-policies) that you can define to suit your business needs. - [How to adjust your sharing settings for SharePoint and OneDrive files and folders](#set-sharing-settings-for-sharepoint-and-onedrive-files-and-folders). - [Alert policies](#review-your-alert-policies) that monitor specific files and how they are used.-- [Next objective](#next-objective) (securing unmanaged devices)+- [Your next objectives](#next-objectives). ## Review and apply preset security policies You can prevent people in your organization from sharing their calendars. You ca If your users are allowed to share their calendars, see [these instructions](https://support.office.com/article/7ecef8ae-139c-40d9-bae2-a23977ee58d5) for how to share from Outlook on the web. -## Next objective +## Next objectives -Okay, now let's [**set up those unmanaged (BYOD) devices**](m365bp-devices-overview.md). +Proceed to: ++- [Set up unmanaged (BYOD) devices](m365bp-devices-overview.md) +- [Protect all email](m365bp-protect-email-overview.md) +- [Collaborate and share securely](m365bp-collaborate-share-securely.md) +- [Set up and secure managed devices](m365bp-protect-devices.md) |
| business-premium | M365bp Security Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-security-overview.md | audience: Admin ms.localizationpriority: high Previously updated : 07/19/2022 Last updated : 08/08/2022 - M365-Campaigns - m365solution-smb Stay vigilant - the safety and reliability of the system relies upon you. Your objectives are to: -- [Turn on security defaults](m365bp-conditional-access.md) (MFA).+- [Turn on security defaults (MFA)](m365bp-conditional-access.md). - [Protect your admin accounts](m365bp-protect-admin-accounts.md). - [Protect against malware and other threats](m365bp-increase-protection.md). |
| commerce | Change Payment Frequency | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/change-payment-frequency.md | Last updated 05/24/2022 When you buy a subscription, you select a billing frequency. To change how often you are billed for a subscription, use the following steps. +> [!NOTE] +> If you have a billing profile, you con only change the billing frequency when you buy or upgrade a subscription. To find out if you have a billing profile, see [View my billing profiles](manage-billing-profiles.md#view-my-billing-profiles). + 1. In the admin center, go to the **Billing**\> <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page. 2. On the **Products** tab, select the subscription that you want to change. 3. On the subscription details page, in the **Subscription and payment settings** section, select **Edit billing frequency**. |
| commerce | Mexico Billing Info | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/mexico-billing-info.md | During the checkout purchase process, when you get to step **4. Payment and bill You can add or modify your RFC so that the information is reflected in future Microsoft 365 for business purchases. To add or modify your RFC, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=2084771" target="_blank">Billing accounts</a> page. > [!NOTE]-> If you're in a monthly or yearly recurrent billing subscription, the addition or modification of the RFC is reflected on the invoice of your next charge. +> If you're in a recurrent billing subscription, the addition or modification of the RFC is reflected on the invoice of your next charge. ## 3. Can I add or modify my RFC to an invoice that was already generated? |
| commerce | Understand Your Invoice | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/understand-your-invoice.md | To learn more, see [View your bill or invoice](view-your-bill-or-invoice.md). If you only have a Microsoft 365 subscription, see [Understand your bill or invoice for Microsoft 365 for business](understand-your-invoice2.md). +## How often and when am I billed? ++Depending on the billing frequency you chose when you bought your subscription, you receive an invoice monthly, every 3 months, every 6 months, or annually. The amount of time since the last invoice date is called the Billing Period and is shown on page one of the invoice, above the Billing Summary section. This time represents the date range during which charges accrue for the current invoice. If you made a change to your subscription outside of this date range, like adding or removing licenses, the associated charges appear on the invoice for the next billing period. ++Starting on page two of the invoice, you see the charges grouped by product order. For Azure customers, the charges might be organized by invoice section. ++At the end of each billing period, you receive an email that says your new invoice is ready to view or download in the Microsoft 365 admin center. If you have more than one billing profile, you receive an invoice for each billing profile. Learn how to [find and view your bill or invoice](view-your-bill-or-invoice.md). + ## Understand the invoice header The top of the first page identifies who is accountable for payment, where the bill is sent to, and a summary of charges. |
| commerce | Add Licenses Bought Through Vlsc | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/add-licenses-bought-through-vlsc.md | - Title: "Add licenses to a VLSC subscription"-- NOCSH--------- M365-subscription-management -- Adm_O365--- commerce_licensing-- AdminSurgePortfolio- -description: "Learn how to add licenses to your Microsoft 365 subscription purchased through the third-party partner, recognized by Microsoft." Previously updated : 05/12/2022---# Add licenses to a subscription purchased through the Volume Licensing Service Center --If you purchased your Microsoft 365 for business or Office 365 Enterprise plan through a third party partner, you must buy additional licenses through that partner. If the partner that the subscription was purchased from is known by Microsoft, you can find out how to contact your partner using the following procedure. - --1. In the admin center, go to the **Billing** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page. ---1. In the admin center, go to the **Billing** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=850626" target="_blank">Your products</a> page. --2. Select the subscription to which you want to add licenses, then select the **Volume Licensing Service Center (VLSC)** link. --3. Follow the steps in the VLSC to complete your purchase. |
| commerce | Subscriptions And Licenses | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/subscriptions-and-licenses.md | Last updated 05/12/2022 # Understand subscriptions and licenses in Microsoft 365 for business -When you buy a subscription to Microsoft 365 for business, you sign up for a set of apps and services that you pay for on either a monthly or an annual basis. The applications and services that you receive as part of your subscription depend on which product you purchased, such as Microsoft 365 Apps for business or Microsoft 365 Business Standard. You can see what comes with each product on the [Microsoft 365 for small and medium-sized businesses](https://www.microsoft.com/microsoft-365/business/compare-all-microsoft-365-business-products) page. +When you buy a subscription to Microsoft 365 for business, you sign up for a set of apps and services that you pay for on a recurring basis. The applications and services that you receive as part of your subscription depend on which product you purchased, such as Microsoft 365 Apps for business or Microsoft 365 Business Standard. You can see what comes with each product on the [Microsoft 365 for small and medium-sized businesses](https://www.microsoft.com/microsoft-365/business/compare-all-microsoft-365-business-products) page. When you buy a subscription, you specify the number of licenses that you need, based on how many people you have in your organization. After you buy a subscription, you create accounts for people in your organization, and then assign a license to each person. As your organizational needs change, you can buy more licenses to accommodate new people, or reassign licenses to other users when someone leaves your organization. |
| commerce | Try Or Buy Microsoft 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/try-or-buy-microsoft-365.md | Are you a new customer, and you don't already have an account with Microsoft? Us 1. Go to the <a href="https://www.aka.ms/office365signup" target="_blank">Microsoft 365 Products site</a>. 2. Select the plan that you want to sign up for, such as **Microsoft 365 Business Standard**, scroll down the page, and select **Try free for 1 month**. 3. On the next page, follow the steps to set up your account.-4. The sign up process may take several minutes to complete. After it\'s complete, you're ready to start the setup wizard for your subscription. For more information about setting up your subscription, see [Next steps](#next-steps). +4. The sign-up process may take several minutes to complete. After it's complete, you're ready to start the setup wizard for your subscription. For more information about setting up your subscription, see [Next steps](#next-steps). ## Buy a subscription from your free trial If you want to buy your subscription before your trial is over, use these steps: 1. In the Microsoft 365 admin center, go to the **Billing** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page. 2. On the **Your products** page, find the subscription that you want to buy. 3. In the **Licenses** section, select **Purchase subscription**.-4. Choose either a monthly or annual commitment for your subscription, then select **Checkout**. +4. Choose a billing frequency for your subscription, then select **Checkout**. 5. On the next page, verify the subscription, and select **Checkout**. 6. On the next page, verify the **Sold to** address, the **Billed to** information, and **Items in this order**. If you need to make any changes, select **Change** next to the applicable section. 7. When you\'re finished, select **Accept agreement & place order**. |
| compliance | Keyword Queries And Search Conditions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/keyword-queries-and-search-conditions.md | The following table lists email message properties that can be searched by using |Property|Property description|Examples|Search results returned by the examples| |||||-|AttachmentNames|The names of files attached to an email message.|`attachmentnames:annualreport.ppt` <p> `attachmentnames:annual*` <br/> `attachmentnames:.pptx`|Messages that have an attached file named annualreport.ppt. In the second example, using the wildcard character ( * ) returns messages with the word "annual" in the file name of an attachment. The third example returns all attachments with the pptx file extension.| -|Bcc|The Bcc field of an email message.<sup>1</sup>|`bcc:pilarp@contoso.com` <p> `bcc:pilarp` <p> `bcc:"Pilar Pinilla"`|All examples return messages with Pilar Pinilla included in the Bcc field.<br>([See Recipient Expansion](keyword-queries-and-search-conditions.md#recipient-expansion))| +|AttachmentNames|The names of files attached to an email message.|`attachmentnames:annualreport.ppt` <p> `attachmentnames:annual*`|Messages that have an attached file named annualreport.ppt. In the second example, using the wildcard character ( * ) returns messages with the word "annual" in the file name of an attachment.<sup>1</sup>|`bcc:pilarp@contoso.com` <p> `bcc:pilarp` <p> `bcc:"Pilar Pinilla"`|All examples return messages with Pilar Pinilla included in the Bcc field.<br>([See Recipient Expansion](keyword-queries-and-search-conditions.md#recipient-expansion))| |Category|The categories to search. Categories can be defined by users by using Outlook or Outlook on the web (formerly known as Outlook Web App). The possible values are: <ul><li>blue<li>green<li>orange<li>purple<li>red<li>yellow</li></ul>|`category:"Red Category"`|Messages that have been assigned the red category in the source mailboxes.| |Cc|The Cc field of an email message.<sup>1</sup>|`cc:pilarp@contoso.com` <p> `cc:"Pilar Pinilla"`|In both examples, messages with Pilar Pinilla specified in the Cc field.<br>([See Recipient Expansion](keyword-queries-and-search-conditions.md#recipient-expansion))| |Folderid|The folder ID (GUID) of a specific mailbox folder. If you use this property, be sure to search the mailbox that the specified folder is located in. Only the specified folder will be searched. Any subfolders in the folder won't be searched. To search subfolders, you need to use the Folderid property for the subfolder you want to search. <p> For more information about searching for the Folderid property and using a script to obtain the folder IDs for a specific mailbox, see [Use Content search for targeted collections](use-content-search-for-targeted-collections.md).|`folderid:4D6DD7F943C29041A65787E30F02AD1F00000000013A0000` <p> `folderid:2370FB455F82FC44BE31397F47B632A70000000001160000 AND participants:garthf@contoso.com`|The first example returns all items in the specified mailbox folder. The second example returns all items in the specified mailbox folder that were sent or received by garthf@contoso.com.| |
| compliance | Use Notifications And Policy Tips | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/use-notifications-and-policy-tips.md | Here are some fine points to understand about using a policy tip to override a r - If the policy tips in the most restrictive rule allow people to override the rule, then overriding this rule also overrides any other rules that the content matched. -- If NotifyAllowOverride action is set with WithoutJustification or WithJustification or FlasePositives, make sure BlockAccess is set to true and BlockAccessScope has appropriate value. Otherwise policy tip will come up but the user will not find an option to override the email with justification.+- If NotifyAllowOverride action is set with WithoutJustification or WithJustification or FalsePositives, make sure BlockAccess is set to true and BlockAccessScope has appropriate value. Otherwise policy tip will come up but the user will not find an option to override the email with justification. #### Availability of Override |
| enterprise | Office 365 Network Mac Perf Onboarding Tool | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/office-365-network-mac-perf-onboarding-tool.md | We measure the download speed for a 15 Mb file from the SharePoint service front #### Buffer bloat -During the 15Mb download we measure the TCP latency to the SharePoint service front door. This is the latency under load and It's compared to the latency when not under load. The increase in latency when under load is often attributable to consumer network device buffers being loaded (or bloated). A network insight is shown for any bloat of 1,000 or more. +During the 15Mb download we measure the TCP latency to the SharePoint service front door. This is the latency under load and it's compared to the latency when not under load. The increase in latency when under load is often attributable to consumer network device buffers being loaded (or bloated). A network insight is shown for any bloat of 100ms or more. #### Service front door recorded in the client DNS |
| includes | Microsoft 365 Content Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/microsoft-365-content-updates.md | +## Week of August 01, 2022 +++| Published On |Topic title | Change | +|||--| +| 8/1/2022 | [Key infrastructure requirements before enrolling in the Microsoft Defender Experts for Hunting service](/microsoft-365/security/defender/before-you-begin-defender-experts?view=o365-21vianet) | added | +| 8/1/2022 | [What is Microsoft Defender Experts for Hunting offering](/microsoft-365/security/defender/defender-experts-for-hunting?view=o365-21vianet) | added | +| 8/1/2022 | [How to subscribe to Microsoft Defender Experts for Hunting](/microsoft-365/security/defender/onboarding-defender-experts-for-hunting?view=o365-21vianet) | added | +| 8/1/2022 | [Understand the Defender Experts for Hunting report in Microsoft 365 Defender](/microsoft-365/security/defender/defender-experts-report?view=o365-21vianet) | modified | +| 8/1/2022 | [How to enable DMARC Reporting for Microsoft Online Email Routing Address (MOERA) and parked Domains](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-enable-dmarc-reporting-for-microsoft-online-email-routing-address-moera-and-parked-domains?view=o365-21vianet) | modified | +| 8/1/2022 | [How to setup automated attacks and training within Attack simulation training](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-setup-attack-simulation-training-for-automated-attacks-and-training?view=o365-21vianet) | modified | +| 8/1/2022 | [Use Cost management in the Microsoft 365 admin center](/microsoft-365/commerce/use-cost-mgmt?view=o365-21vianet) | modified | +| 8/1/2022 | [Microsoft Defender for Endpoint Device Control Removable Storage Access Control, removable storage media](/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control?view=o365-21vianet) | modified | +| 8/1/2022 | [Migrating servers from Microsoft Defender for Endpoint to Microsoft Defender for Cloud](/microsoft-365/security/defender-endpoint/migrating-mde-server-to-cloud?view=o365-21vianet) | added | +| 8/1/2022 | [What's new in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-whats-new?view=o365-21vianet) | modified | +| 8/1/2022 | [Server migration scenarios for the new version of Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/server-migration?view=o365-21vianet) | modified | +| 8/1/2022 | [Glossary of security terms for Microsoft 365 security capabilities](/microsoft-365/business-premium/m365bp-glossary?view=o365-21vianet) | modified | +| 8/1/2022 | [Paying for your subscription](/microsoft-365/commerce/billing-and-payments/pay-for-your-subscription?view=o365-21vianet) | modified | +| 8/1/2022 | [Bulk import external contacts to Exchange Online](/microsoft-365/compliance/bulk-import-external-contacts?view=o365-21vianet) | modified | +| 8/1/2022 | [Microsoft Defender for Endpoint Device Control Removable Storage Protection](/microsoft-365/security/defender-endpoint/device-control-removable-storage-protection?view=o365-21vianet) | modified | +| 8/1/2022 | [What's new in Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-whatsnew?view=o365-21vianet) | modified | +| 8/1/2022 | [Submit files for analysis by Microsoft](/microsoft-365/security/intelligence/submission-guide?view=o365-21vianet) | modified | +| 8/2/2022 | [View your Threat & Vulnerability Management dashboard in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-view-tvm-dashboard?view=o365-21vianet) | modified | +| 8/2/2022 | [Configure Microsoft Defender for Endpoint risk signals using App Protection Policies (MAM)](/microsoft-365/security/defender-endpoint/android-configure-mam?view=o365-21vianet) | modified | +| 8/2/2022 | [Configure Microsoft Defender for Endpoint on Android features](/microsoft-365/security/defender-endpoint/android-configure?view=o365-21vianet) | modified | +| 8/2/2022 | [Allow or block emails using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/allow-block-email-spoof?view=o365-21vianet) | modified | +| 8/2/2022 | [Manage your allows and blocks in the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list?view=o365-21vianet) | modified | +| 8/3/2022 | [Microsoft 365 Group mailbox size management](/microsoft-365/admin/create-groups/group-mailbox-size-management?view=o365-21vianet) | added | +| 8/3/2022 | [What's new in Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-whatsnew?view=o365-21vianet) | modified | +| 8/3/2022 | [Migrating servers from Microsoft Defender for Endpoint to Microsoft Defender for Cloud](/microsoft-365/security/defender-endpoint/migrating-mde-server-to-cloud?view=o365-21vianet) | modified | +| 8/3/2022 | [Configure local overrides for Microsoft Defender Antivirus settings](/microsoft-365/security/defender-endpoint/configure-local-policy-overrides-microsoft-defender-antivirus?view=o365-21vianet) | modified | +| 8/4/2022 | [Export non product code software inventory assessment per device](/microsoft-365/security/defender-endpoint/get-assessment-non-cpe-software-inventory?view=o365-worldwide) | added | +| 8/4/2022 | [Export assessment methods and properties per device](/microsoft-365/security/defender-endpoint/get-assessment-methods-properties?view=o365-21vianet) | modified | +| 8/4/2022 | [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-21vianet) | modified | +| 8/4/2022 | [Performance analyzer for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/tune-performance-defender-antivirus?view=o365-21vianet) | modified | +| 8/4/2022 | [Paying for your subscription](/microsoft-365/commerce/billing-and-payments/pay-for-your-subscription?view=o365-21vianet) | modified | +| 8/4/2022 | [Help your clients and customers use virtual appointments](/microsoft-365/frontline/virtual-appointments-toolkit?view=o365-21vianet) | modified | +| 8/4/2022 | [Migrating servers from Microsoft Monitoring Agent to the unified solution](/microsoft-365/security/defender-endpoint/application-deployment-via-mecm?view=o365-21vianet) | modified | +| 8/5/2022 | [Use Microsoft Teams meetings with Blackboard Learn](/microsoft-365/lti/teams-meetings-with-blackboard-learn?view=o365-worldwide) | added | +| 8/5/2022 | [Guest users in the Microsoft 365 admin center](/microsoft-365/admin/add-users/about-guest-users?view=o365-worldwide) | modified | +| 8/5/2022 | [Manage guest access in Microsoft 365 groups](/microsoft-365/admin/create-groups/manage-guest-access-in-groups?view=o365-worldwide) | modified | +| 8/5/2022 | [Manage data for Microsoft Whiteboard](/microsoft-365/whiteboard/manage-data-organizations?view=o365-worldwide) | modified | +| 8/5/2022 | [Manage sharing for Microsoft Whiteboard in GCC High environments](/microsoft-365/whiteboard/manage-sharing-gcc-high?view=o365-worldwide) | modified | +| 8/5/2022 | [Manage sharing for Microsoft Whiteboard](/microsoft-365/whiteboard/manage-sharing-organizations?view=o365-worldwide) | modified | +| 8/5/2022 | [Microsoft 365 Business Premium overview](/microsoft-365/business-premium/index?view=o365-worldwide) | modified | +| 8/5/2022 | [Collaborate and share securely in Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-collaborate-share-securely?view=o365-worldwide) | modified | +| 8/5/2022 | [Set Up unmanaged devices overview](/microsoft-365/business-premium/m365bp-devices-overview?view=o365-worldwide) | modified | +| 8/5/2022 | [Set up and secure managed devices](/microsoft-365/business-premium/m365bp-protect-devices?view=o365-worldwide) | modified | +| 8/5/2022 | [Use email securely](/microsoft-365/business-premium/m365bp-protect-email-overview?view=o365-worldwide) | modified | +| 8/5/2022 | [Increase security in Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-security-overview?view=o365-worldwide) | modified | +| 8/5/2022 | [Welcome to Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-setup-overview?view=o365-worldwide) | modified | +| 8/5/2022 | [Set up Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-setup?view=o365-worldwide) | modified | +| 8/5/2022 | [Deploy, manage, and report on Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/deploy-manage-report-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 8/5/2022 | [Configure and manage Microsoft Threat Experts capabilities through Microsoft 365 Defender](/microsoft-365/security/defender/configure-microsoft-threat-experts?view=o365-worldwide) | modified | ++ ## Week of July 25, 2022 | 7/8/2022 | [Microsoft Purview solutions trial playbook](/microsoft-365/compliance/compliance-easy-trials-compliance-playbook?view=o365-21vianet) | modified | | 7/8/2022 | [Office TLS certificate changes](/microsoft-365/compliance/encryption-office-365-tls-certificates-changes?view=o365-21vianet) | modified | | 7/8/2022 | [Switch to Microsoft Defender for Endpoint - Setup](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-2?view=o365-21vianet) | modified |---## Week of June 27, 2022 ---| Published On |Topic title | Change | -|||--| -| 6/27/2022 | [Learn about exact data match based sensitive information types](/microsoft-365/compliance/sit-learn-about-exact-data-match-based-sits?view=o365-21vianet) | modified | -| 6/27/2022 | [Sign up for Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-sign-up?view=o365-21vianet) | modified | -| 6/27/2022 | [Fix unhealthy sensors in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/fix-unhealthy-sensors?view=o365-21vianet) | modified | -| 6/27/2022 | [Configure the delivery of third-party phishing simulations to users and unfiltered messages to SecOps mailboxes](/microsoft-365/security/office-365-security/configure-advanced-delivery?view=o365-21vianet) | modified | -| 6/27/2022 | [Login pages in Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-login-pages?view=o365-21vianet) | added | -| 6/27/2022 | [Communication compliance policies](/microsoft-365/compliance/communication-compliance-policies?view=o365-21vianet) | modified | -| 6/27/2022 | [Microsoft Purview extensibility](/microsoft-365/compliance/compliance-extensibility?view=o365-21vianet) | modified | -| 6/27/2022 | [Data Loss Prevention policy reference](/microsoft-365/compliance/dlp-policy-reference?view=o365-21vianet) | modified | -| 6/27/2022 | [Get started with troubleshooting mode in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/enable-troubleshooting-mode?view=o365-21vianet) | modified | -| 6/28/2022 | [Overview of the Microsoft Defender for Endpoint page in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-device-security-overview?view=o365-21vianet) | added | -| 6/28/2022 | [Add a domain to Microsoft 365](/microsoft-365/admin/setup/add-domain?view=o365-21vianet) | modified | -| 6/28/2022 | [DLP policy conditions, exceptions, and actions](/microsoft-365/compliance/dlp-conditions-and-exceptions?view=o365-21vianet) | modified | -| 6/28/2022 | [Office TLS certificate changes](/microsoft-365/compliance/encryption-office-365-tls-certificates-changes?view=o365-21vianet) | modified | -| 6/28/2022 | [Get started with the Microsoft Service Trust Portal](/microsoft-365/compliance/get-started-with-service-trust-portal?view=o365-21vianet) | modified | -| 6/28/2022 | [Onboard Windows servers to the Microsoft Defender for Endpoint service](/microsoft-365/security/defender-endpoint/configure-server-endpoints?view=o365-21vianet) | modified | -| 6/28/2022 | [What's new in Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-whatsnew?view=o365-21vianet) | modified | -| 6/28/2022 | [Case study - Contoso configures an inappropriate text policy](/microsoft-365/compliance/communication-compliance-case-study?view=o365-21vianet) | modified | -| 6/28/2022 | [Get started with communication compliance](/microsoft-365/compliance/communication-compliance-configure?view=o365-21vianet) | modified | -| 6/28/2022 | [Configure and review priority accounts in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/configure-review-priority-account?view=o365-21vianet) | modified | -| 6/29/2022 | [Defender for Endpoint onboarding Windows Client](/microsoft-365/security/defender-endpoint/onboard-windows-client?view=o365-21vianet) | added | -| 6/29/2022 | [Defender for Endpoint onboarding Windows Server](/microsoft-365/security/defender-endpoint/onboard-windows-server?view=o365-21vianet) | added | -| 6/29/2022 | [DeviceTvmInfoGathering table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-devicetvminfogathering-table?view=o365-21vianet) | added | -| 6/29/2022 | [DeviceTvmInfoGatheringKB table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-devicetvminfogatheringkb-table?view=o365-21vianet) | added | -| 6/29/2022 | [Onboard Windows devices to Defender for Endpoint using Intune](/microsoft-365/security/defender-endpoint/configure-endpoints-mdm?view=o365-21vianet) | modified | -| 6/29/2022 | Onboarding tools and methods for Windows devices | removed | -| 6/29/2022 | [Onboard Windows servers to the Microsoft Defender for Endpoint service](/microsoft-365/security/defender-endpoint/configure-server-endpoints?view=o365-21vianet) | modified | -| 6/29/2022 | [Onboard devices and configure Microsoft Defender for Endpoint capabilities](/microsoft-365/security/defender-endpoint/onboard-configure?view=o365-21vianet) | modified | -| 6/29/2022 | [Hunt for exposed devices](/microsoft-365/security/defender-vulnerability-management/tvm-hunt-exposed-devices?view=o365-21vianet) | modified | -| 6/29/2022 | [Integrate your SIEM tools with Microsoft 365 Defender](/microsoft-365/security/defender/configure-siem-defender?view=o365-21vianet) | modified | -| 6/29/2022 | [Stream Microsoft 365 Defender events to your Storage account](/microsoft-365/security/defender/streaming-api-storage?view=o365-21vianet) | modified | -| 6/29/2022 | [Configuration Analyzer for Microsoft Purview](/microsoft-365/compliance/compliance-manager-mcca?view=o365-21vianet) | modified | -| 6/29/2022 | [Onboard previous versions of Windows on Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboard-downlevel?view=o365-21vianet) | modified | -| 6/29/2022 | [Protect macOS security settings with tamper protection](/microsoft-365/security/defender-endpoint/tamperprotection-macos?view=o365-21vianet) | modified | -| 6/29/2022 | [Introduction to Microsoft Whiteboard](/microsoft-365/whiteboard/index?view=o365-21vianet) | modified | -| 6/29/2022 | [Manage sensitivity labels in Office apps](/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-21vianet) | modified | -| 6/30/2022 | [Microsoft 365 documentation # < 60 chars](/microsoft-365/index?view=o365-21vianet) | modified | -| 6/30/2022 | [About Intune admin roles in the Microsoft 365 admin center](/microsoft-365/business-premium/m365bp-intune-admin-roles-in-the-mac?view=o365-21vianet) | added | -| 6/30/2022 | [A security incident operations guide](/microsoft-365/business-premium/m365bp-security-incident-quick-start?view=o365-21vianet) | added | -| 6/30/2022 | [Overview of Quarantined Messages in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-quarantine-messages-overview?view=o365-21vianet) | added | -| 6/30/2022 | [Increase threat protection for Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-increase-protection?view=o365-21vianet) | modified | -| 6/30/2022 | [Onboard your organization's devices to Microsoft Defender for Business](/microsoft-365/business-premium/m365bp-onboard-devices-mdb?view=o365-21vianet) | modified | -| 6/30/2022 | [Get started with Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-setup?view=o365-21vianet) | modified | -| 6/30/2022 | [Get started with the Microsoft Service Trust Portal](/microsoft-365/compliance/get-started-with-service-trust-portal?view=o365-21vianet) | modified | -| 6/30/2022 | [Turn on network protection](/microsoft-365/security/defender-endpoint/enable-network-protection?view=o365-21vianet) | modified | -| 7/1/2022 | [Microsoft 365 admin center browser usage reports](/microsoft-365/admin/activity-reports/browser-usage-report?view=o365-21vianet) | modified | -| 7/1/2022 | [Connect your domain to Microsoft 365](/microsoft-365/admin/moveto-microsoft-365/connect-domain-tom365?view=o365-worldwide) | modified | -| 7/1/2022 | [Migrate Google files to Microsoft 365 for business](/microsoft-365/admin/moveto-microsoft-365/migrate-files-migration-manager?view=o365-worldwide) | modified | -| 7/1/2022 | [Increase threat protection for Microsoft 365 for business](/microsoft-365/admin/security-and-compliance/increase-threat-protection?view=o365-21vianet) | modified | -| 7/1/2022 | [Best practices for securing Microsoft 365 for business](/microsoft-365/admin/security-and-compliance/secure-your-business-data?view=o365-21vianet) | modified | -| 7/1/2022 | [Start retention when an event occurs](/microsoft-365/compliance/event-driven-retention?view=o365-21vianet) | modified | -| 7/1/2022 | [What's new in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-whats-new?view=o365-21vianet) | modified | -| 7/1/2022 | [Report false positives and false negatives in Outlook](/microsoft-365/security/office-365-security/report-false-positives-and-false-negatives?view=o365-21vianet) | modified | -| 7/1/2022 | [User reported message settings](/microsoft-365/security/office-365-security/user-submission?view=o365-21vianet) | modified | -| 7/1/2022 | [Manage Microsoft Defender for Endpoint after initial setup or migration](/microsoft-365/security/defender-endpoint/manage-mde-post-migration?view=o365-21vianet) | modified | -| 7/1/2022 | [Migration and setup guides to move to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/migration-guides?view=o365-21vianet) | modified | -| 7/1/2022 | [Upgrade Windows devices to Windows 10 Pro](/microsoft-365/business-premium/m365bp-upgrade-windows-10-pro?view=o365-21vianet) | added | -| 7/1/2022 | [Secure Windows devices](/microsoft-365/business-premium/m365bp-secure-windows-devices?view=o365-21vianet) | modified | -| 7/2/2022 | [Login pages in Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-login-pages?view=o365-21vianet) | modified | -| 7/2/2022 | [Simulation automations for Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-simulation-automations?view=o365-21vianet) | modified | -| 7/2/2022 | [Simulate a phishing attack with Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training?view=o365-21vianet) | modified | |
| security | TOC | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/TOC.md | --- ### [Microsoft Defender for Endpoint on other Operating Systems]() #### [Onboard non-Windows devices](configure-endpoints-non-windows.md) ####### [Get Investigation](get-investigation-object.md) ####### [Start Investigation](initiate-autoir-investigation.md) +###### [Device Health]() +####### [Export device health methods and properties](device-health-api-methods-properties.md) +####### [Export device antivirus health report](device-health-export-antivirus-health-report-api.md) + ###### [Certificate inventory]() ####### [Export certificate inventory assessment](export-certificate-inventory-assessment.md) |
| security | Advanced Hunting Devicealertevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/advanced-hunting-devicealertevents-table.md | ms.technology: mde **Applies to:** - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) -> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +> [!IMPORTANT] +> The `AlertInfo` and `AlertEvidence` tables replace the `DeviceAlertEvents` table in the Microsoft Defender for Endpoint schema. To learn more, see [Map DeviceAlertEvents Table](/microsoft-365/security/defender/advanced-hunting-migrate-from-mde). ++Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The `DeviceAlertEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about alerts in Microsoft 365 Defender. Use this reference to construct queries that return information from the table. |
| security | Api Release Notes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/api-release-notes.md | The following information lists the updates made to the Microsoft Defender for E ## Release notes - newest to oldest (dd.mm.yyyy) +### 08.08.2022 ++- Added new Export Device Health API method - GET /api/public/avdeviceshealth [Export device health methods and properties](device-health-api-methods-properties.md) + ### 06.10.2021 - Added new Export assessment API method - _Delta Export software vulnerabilities assessment (JSON response)_ [Export assessment methods and properties per device](get-assessment-methods-properties.md). |
| security | Configure Endpoints Sccm | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints-sccm.md | Configure all available rules to Audit. > [!NOTE] > Blocking these activities may interrupt legitimate business processes. The best approach is setting everything to audit, identifying which ones are safe to turn on, and then enabling those settings on endpoints which do not have false positive detections. +For deploying AV and ASR policies through Microsoft System Center Configuration Manager (SCCM) follow the steps: ++- Enable Endpoint Protection and configure custom client settings. +- Install the Endpoint Protection client from a command prompt. +- Verify the Endpoint Protection client installation. ++##### Enable Endpoint Protection and configure custom client settings +Follow the steps to enable endpoint protection and configuration of custom client settings: ++1. In the Configuration Manager console, click **Administration.** +1. In the **Administration** workspace, click **Client Settings.** +1. On the **Home** tab, in the **Create** group, click **Create Custom Client Device Settings.** +1. In the **Create Custom Client Device Settings** dialog box, provide a name and a description for the group of settings, and then select **Endpoint Protection.** +1. Configure the Endpoint Protection client settings that you require. For a full list of Endpoint Protection client settings that you can configure, see the Endpoint Protection section in [About client settings.](/mem/configmgr/core/clients/deploy/about-client-settings#endpoint-protection) ++ > [!IMPORTANT] + > Install the Endpoint Protection site system role before you configure client settings for Endpoint Protection. ++1. Click **OK** to close the **Create Custom Client Device Settings** dialog box. The new client settings are displayed in the **Client Settings** node of the **Administration** workspace. +1. Next, deploy the custom client settings to a collection. Select the custom client settings you want to deploy. In the **Home** tab, in the **Client Settings** group, click **Deploy.** +1. In the **Select Collection** dialog box, choose the collection to which you want to deploy the client settings and then click **OK.** The new deployment is shown in the **Deployments** tab of the details pane. ++Clients are configured with these settings when they next download client policy. For more information, see [Initiate policy retrieval for a Configuration Manager client.](/mem/configmgr/core/clients/manage/manage-clients) +++##### Installation of Endpoint Protection client from a command prompt +Follow the steps to complete installation of endpoint protection client from the command prompt. ++1. Copy **scepinstall.exe** from the **Client** folder of the Configuration Manager installation folder to the computer on which you want to install the Endpoint Protection client software. +1. Open a command prompt as an administrator. Change directory to the folder with the installer. Then run ```scepinstall.exe```, adding any extra command-line properties that you require: ++ |**Property** |**Description** | + ||| + |```/s``` |Run the installer silently| + |```/q``` |Extract the setup files silently| + |```/i``` |Run the installer normally| + |```/policy``` |Specify an antimalware policy file to configure the client during installation| + |```/sqmoptin```|Opt-in to the Microsoft Customer Experience Improvement Program (CEIP)| ++1. Follow the on-screen instructions to complete the client installation. +1. If you downloaded the latest update definition package, copy the package to the client computer, and then double-click the definition package to install it. ++ > [!NOTE] + > After the Endpoint Protection client install completes, the client automatically performs a definition update check. If this update check succeeds, you don't have to manually install the latest definition update package. ++**Example: install the client with an antimalware policy** ++```scepinstall.exe /policy <full path>\<policy file>``` ++##### Verify the Endpoint Protection client installation ++After you install the Endpoint Protection client on your reference computer, verify that the client is working correctly. ++1. On the reference computer, open **System Center Endpoint Protection** from the Windows notification area. +1. On the **Home** tab of the **System Center Endpoint Protection** dialog box, verify that **Real-time protection** is set to **On.** +1. Verify that **Up-to-date** is displayed for **Virus and spyware definitions.** +1. To make sure that your reference computer is ready for imaging, under **Scan options,** select **Full,** and then click **Scan now.** ++ #### Network protection Prior to enabling network protection in audit or block mode, ensure that you've installed the antimalware platform update, which can be obtained from the [support page](https://support.microsoft.com/help/4560203/windows-defender-anti-malware-platform-binaries-are-missing). |
| security | Configure Microsoft Threat Experts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-microsoft-threat-experts.md | You'll start receiving Endpoint Attack Notifications from Microsoft Threat Exper 2. From the dashboard, select the same alert topic that you got from the email, to view the details. ++### Filter to view just the Endpoint Attack Notifications +You can filter your incidents and alerts if you want to only see the Defender Experts Notifications amongst the many alerts. To do so: ++1. On the navigation menu, go to **Incidents & alerts** > **Incidents** > select the Filter icon icon. +2. Scroll down to the Tags field > select the **Defender Experts** check box. +3. Select **Apply**. + ## Subscribe to Microsoft Threat Experts - Experts on Demand This is available as a subscription service. If you're already a Defender for Endpoint customer, you can contact your Microsoft representative to subscribe to Microsoft Threat Experts - Experts on Demand. -## Consult a Microsoft threat expert about suspicious cybersecurity activities in your organization +## Ask Defender Experts about suspicious cybersecurity activities in your organization You can partner with Microsoft Threat Experts who can be engaged directly from within the Microsoft 365 Defender portal for their response. Experts provide insights to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised device, or a threat intelligence context that you see on your portal dashboard. > [!NOTE] > > - Alert inquiries related to your organization's customized threat intelligence data are currently not supported. Consult your security operations or incident response team for details.-> - You need to have the **Manage security settings** permission in the Microsoft 365 Defender portal to be able to submit a "Consult a threat expert" inquiry. +> - You need to have the **Manage security settings** permission in the Microsoft 365 Defender portal to be able to submit the **Ask Defender Experts** inquiry. 1. Navigate to the portal page with the relevant information that you'd like to investigate, for example, the **Incident** page. Ensure that the page for the relevant alert or device is in view before you send an investigation request. -2. From the upper right-hand menu, click the **?** icon. Then, select **Consult a threat expert**. -- :::image type="content" source="images/mte-eod-menu.png" alt-text="The Microsoft Threat Experts Experts on Demand menu item" lightbox="images/mte-eod-menu.png"::: +2. From the upper right-hand menu, click the **?** icon. Then, select **Ask Defender Experts ** - A flyout screen opens. The following screen shows when you are on a trial subscription. +A flyout screen opens. The following screen shows when you are on a trial subscription. The following screen shows when you are on a full Microsoft Threat Experts - Experts on Demand subscription. - :::image type="content" source="images/mte-eod.png" alt-text="The Microsoft Threat Experts Experts on Demand page" lightbox="images/mte-eod.png"::: -- The following screen shows when you are on a full Microsoft Threat Experts - Experts on-Demand subscription. -- :::image type="content" source="images/mte-eod-fullsubscription.png" alt-text="The Microsoft Threat Experts Experts on Demand full subscription page" lightbox="images/mte-eod-fullsubscription.png"::: -- The **Inquiry topic** field is pre-populated with the link to the relevant page for your investigation request. For example, a link to the incident, alert, or device details page that you were at when you made the request. +The **Inquiry topic** field is pre-populated with the link to the relevant page for your investigation request. For example, a link to the incident, alert, or device details page that you were at when you made the request. 3. In the next field, provide enough information to give the Microsoft Threat Experts enough context to start the investigation. Watch this video for a quick overview of the Microsoft Services Hub. - We detected a phishing email that delivered a malicious Word document to a user. The malicious Word document caused a series of suspicious events, which triggered multiple Endpoint Attack Notifications alerts for [malware name] malware. Do you have any information on this malware? If yes, can you send me a link? - I recently saw a [social media reference, for example, Twitter or blog] post about a threat that is targeting my industry. Can you help me understand what protection Defender for Endpoint provides against this threat actor? -### Microsoft Threat Experts' alert communications +### Defender Experts' alert communications - Can your incident response team help us address the Endpoint Attack Notifications that we got? - I received this Endpoint Attack Notifications from Microsoft Threat Experts. We don't have our own incident response team. What can we do now, and how can we contain the incident? Watch this video for a quick overview of the Microsoft Services Hub. ### Receive a progress report about your managed hunting inquiry -Response from Microsoft Threat Experts varies according to your inquiry. They will email a progress report to you about your **Consult a threat expert** inquiry within two days, to communicate the investigation status from the following categories: +Response from Microsoft Threat Experts varies according to your inquiry. They will email a progress report to you about your **Ask Defender Experts** inquiry within two days, to communicate the investigation status from the following categories: - More information is needed to continue with the investigation - A file or several file samples are needed to determine the technical context Response from Microsoft Threat Experts varies according to your inquiry. They wi It is crucial to respond in quickly to keep the investigation moving. -## Related topic --- [Microsoft Threat Experts overview](microsoft-threat-experts.md)-- [Microsoft Threat Experts in Microsoft 365 Overview](/microsoft-365/security/mtp/microsoft-threat-experts)+#### To proactively hunt threats across endpoints, Office 365, cloud applications, and identity, refer to: +- [Microsoft Defender Experts in Microsoft 365 Overview](defender-experts-for-hunting.md) |
| security | Device Control Removable Storage Access Control | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control.md | The [Microsoft 365 Defender portal](https://security.microsoft.com/advanced-hunt - Microsoft 365 for E5 reporting +If `AuditAllowed` or `AuditDenied` is configured in your policy and **Send event** is selected in **Options**, an event will be sent to Advanced hunting or the Device control report for every covered access (`AccessMask` in the entry), regardless of whether it was initiated by the system or by the user who signed in. + ```kusto //RemovableStoragePolicyTriggered: event triggered by Disk level enforcement DeviceEvents |
| security | Device Health Api Methods Properties | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-health-api-methods-properties.md | + + Title: Microsoft Defender Antivirus export device antivirus health details API methods and properties +description: "Learn how to export a list of Microsoft Defender Antivirus device health details." +keywords: apis, graph api, supported apis, get, device health api, Microsoft Defender for Endpoint report api microsoft defender reports api, microsoft defender for endpoint reporting api, windows defender reporting api, defender for endpoint reporting api, windows defender report api +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium Last updated : 08/08/2022++audience: ITPro +++MS.technology: mde ++ ++# Export device antivirus health details API methods and properties ++**Applies to:** ++- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ++> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) +++++## Export device antivirus health details API description ++Retrieves a list of Microsoft Defender Antivirus device health details. This API has different API calls (methods) to get different types of data. Because the amount of data can be large, there are two ways it can be retrieved: ++- **JSON response** The API pulls all data in your organization as JSON responses. This method is best for _small organizations with less than 100-K devices_. The response is paginated, so you can use the \@odata.nextLink field from the response to fetch the next results. ++- **via files** This API solution enables pulling larger amounts of data faster and more reliably. So, it's recommended for large organizations, with more than 100-K devices. This API pulls all data in your organization as download files. The response contains URLs to download all the data from Azure Storage. This API enables you to download all your data from Azure Storage as follows: + - Call the API to get a list of download URLs with all your organization data. + - Download all the files using the download URLs and process the data as you like. ++Data that is collected using either '_JSON response_ or _via files_' is the current snapshot of the current state. It doesn't contain historic data. To collect historic data, customers must save the data in their own data storages. ++> [!IMPORTANT] +> +> For Windows Server 2012 R2 and Windows Server 2016 to appear in device health reports, these devices must be onboarded using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016](/microsoft-365/security/defender-endpoint/configure-server-endpoints#new-windows-server-2012-r2-and-2016-functionality-in-the-modern-unified-solution). ++> [!NOTE] +> +> For information about using the **Device health and antivirus compliance** reporting tool in the Microsoft 365 Security dashboard, see: [Device health and antivirus compliance report in Microsoft Defender for Endpoint](machine-reports.md). +> ++### 1.1 Export device antivirus health details API methods ++Method|Data type|Description +:|:|: +**(JSON response)**|Microsoft Defender Antivirus health per device collection. See: [1.2 Export device antivirus health details API properties (JSON response)](#12-export-device-antivirus-health-details-api-properties-json-response)|Returns a table with an entry for every unique combination of DeviceId, ConfigurationId. | The API pulls all data in your organization as JSON responses. This method is best for small organizations with less than 100-K devices. The response is paginated, so you can use the @odata.nextLink field from the response to fetch the next results. +**(via files)**|Microsoft Defender Antivirus health per device collection. See: [1.3 Export device antivirus health details API properties \(via files\)](#13-export-device-antivirus-health-details-api-properties-via-files)|Returns a table with an entry for every unique combination of DeviceId, ConfigurationId. |This API solution enables pulling larger amounts of data faster and more reliably. So, it's recommended for large organizations, with more than 100-K devices. This API pulls all data in your organization as download files. The response contains URLs to download all the data from Azure Storage. This API enables you to download all your data from Azure Storage as follows: <ol><li>Call the API to get a list of download URLs with all your organization data.</li><li>Download all the files using the download URLs and process the data as you like.</li></ol> ++### 1.2 Export device antivirus health details API properties (JSON response) ++> [!NOTE] +> +> - The properties defined in the following table are listed alphabetically, by property ID. When running this API, the resulting output will not necessarily be returned in the same order listed in this table. +> - Some additional columns might be returned in the response. These columns are temporary and might be removed, please use only the documented columns. ++| Property (ID) | Data type | Description | Example of a returned value | +|:-|:-|:-|:-| +| avEngineUpdateTime | DateTimeOffset | Datetime when AV engine was last updated on device | ΓÇ£2022-08-04T12:44:02ZΓÇ£ | +| avEngineVersion | String | Antivirus engine version | ΓÇ£1.1.19400.3ΓÇ¥ | +| avIsEngineUpToDate | String | Up-to-date status of AV engine | ΓÇ£TrueΓÇ¥, ΓÇ£FalseΓÇ¥, ΓÇ£UnknownΓÇ¥ | +| avIsPlatformUpToDate | String | Up-to-date stauts of AV platform | ΓÇ£TrueΓÇ¥, ΓÇ£FalseΓÇ¥, ΓÇ£UnknownΓÇ¥ | +| avIsSignatureUpToDate | String | Up-to-date status of AV signature | ΓÇ£TrueΓÇ¥, ΓÇ£FalseΓÇ¥, ΓÇ£UnknownΓÇ¥ | +| avMode | String | Antivirus mode. | Each mode will be a string typed integer value ranging from 0 to 5. Refer to the mapping below to see its valueΓÇÖs meaning: <ul><li>'' = Other</li><li> '0' = Active</li><li> '1' = Passive</li><li> '2' = Disabled</li><li> '3' = Other</li><li> '4' = EDRBlocked</li><li>'5' = PassiveAudit</li></ul> | +| avPlatformUpdateTime | DateTimeOffset | Datetime when AV platform was last updated on device | ΓÇ£2022-08-04T12:44:02ZΓÇ¥ | +| avPlatformVersion | String | Antivirus platform version | ΓÇ£4.18.2203.5ΓÇ¥ | +| avSignaturePublishTime | DateTimeOffset | Datetime when AV security intelligence build was released | ΓÇ£2022-08-04T12:44:02ZΓÇ¥ | +| avSignatureUpdateTime | DateTimeOffset | Datetime when AV security intelligence was last updated on device | ΓÇ£2022-08-04T12:44:02ZΓÇ£ | +| avSignatureVersion | String | Antivirus security intelligence version | ΓÇ£1.371.1323.0ΓÇ¥ | +| computerDnsName | String | DNS name | ΓÇ£SampleDnsΓÇ¥ | +| dataRefreshTimestamp | DateTimeOffset | Datetime when data is refreshed for this report | ΓÇ£2022-08-04T12:44:02ZΓÇ£ | +| fullScanError | String | Error codes from full scan | ΓÇ£0x80508023ΓÇ£ | +| fullScanResult | String | Full scan result of this device | ΓÇ£CompletedΓÇ£ <br> ΓÇ£Cancelled ΓÇ£ <br>ΓÇ£FailedΓÇ£ | +| fullScanTime | DateTimeOffset | Datetime when full scan has completed | ΓÇ£2022-08-04T12:44:02ZΓÇ£ | +| id | String | Machine GUID | ΓÇ£30a8fa2826abf24d24379b23f8a44d471f00feabΓÇ¥ | +| lastSeenTime | DateTimeOffset | Last seen datetime of this machine | ΓÇ£2022-08-04T12:44:02ZΓÇ¥ | +| machineId | String | Machine GUID | ΓÇ£30a8fa2826abf24d24379b23f8a44d471f00feabΓÇ¥ | +| osKind | String | Operating system kind | ΓÇ£windowsΓÇ¥, ΓÇ£macΓÇ¥, ΓÇ£linuxΓÇ¥ | +| osPlatform | String | Operating system major version name | Windows 10, macOs | +| osVersion | String | Operating system version | 10.0.18363.1440, 12.4.0.0 | +| quickScanError | String | Error codes from quick scan | ΓÇ£0x80508023ΓÇ£ | +| quickScanResult | String | Quick scan result of this device | ΓÇ£CompletedΓÇ£ <br>ΓÇ£Cancelled ΓÇ£ <br>ΓÇ£FailedΓÇ£ | +| quickScanTime | DateTimeOffset | Datetime when quick scan has completed | ΓÇ£2022-08-04T12:44:02ZΓÇ£ | +| rbacGroupId | Long | Device group ID that this machine belongs to | 712 | +| rbacGroupName | String | Name of device group that this machine belongs to | ΓÇ£SampleGroupΓÇ¥ | ++### 1.3 Export device antivirus health details API properties (via files) ++> [!NOTE] +> +> - The files are gzip compressed & in multiline Json format. +> - The download URLs are only valid for 3 hours; otherwise you can use the parameter. +> - For maximum download speed of your data, you can make sure you are downloading from the same Azure region that your data resides. +> - Each record is approximately 1KB of data. You should take this into account when choosing the correct pageSize parameter for you. +> - Some additional columns might be returned in the response. These columns are temporary and might be removed, please use only the documented columns. ++| Property (ID) | Data type | Description | Example of a returned value | +|:-|:-|:-|:-| +| Export files | array[string] | A list of download URLs for files holding the current snapshot of the organization. | ["https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...1", "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...2"] | +| GeneratedTime | String | The time that the export was generated. | 2022-05-20T08:00:00Z | ++> [!NOTE] +> In each of the Export files a property ΓÇ£DeviceGatheredInfoΓÇ¥ containing the data about Antivirus information can be found. Each of its attributes can provide you with information on the device's health and its status. ++## See also ++[Export device antivirus health report](device-health-export-antivirus-health-report-api.md) ++[Device health and compliance reporting](machine-reports.md) |
| security | Device Health Api | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-health-api.md | + + Title: Microsoft Defender Antivirus Device Health details API +description: "Retrieves a list of Microsoft Defender Antivirus device health details." +keywords: apis, graph api, supported apis, get, device health api, Microsoft Defender for Endpoint report api microsoft defender reports api, microsoft defender for endpoint reporting api, windows defender reporting api, defender for endpoint reporting api, windows defender report api +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium Last updated : 08/08/2022++audience: ITPro +++MS.technology: mde ++ ++# Microsoft Defender Antivirus Device Health details API ++**Applies to:** ++- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ++> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) +++++## API description ++Retrieves a list of Microsoft Defender Antivirus device health details. +URL: GET: /api/public/avdeviceshealth +<br>Supports [OData V4 queries](https://www.odata.org/documentation/). +<br>OData supported operators: +<br>```$filter``` on: ```machineId```, ```computerDnsName```, ```osKind```, ```osPlatform```, ```osVersion```, a```vMode```, ```avSignatureVersion```, ```avEngineVersion```, ```avPlatformVersion```, ```quickScanResult```, ```quickScanError```, ```fullScanResult```, ```fullScanError```, ```avIsSignatureUpToDate```, ```avIsEngineUpToDate```, ```vIsPlatformUpToDate```, ```rbacGroupId``` +<br>```$top``` with max value of 10,000. +<br>```$skip```. +<br>See examples at [OData queries with Microsoft Defender for Endpoint.](exposed-apis-odata-samples.md] ++## Permissions ++One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md) for details. ++| Permission type | Permission | Permission display name | +|:-|:-|:-| +| Application | Machine.Read.All | 'Read all machine profiles' | +| Application | Machine.ReadWrite.All | 'Read and write all machine information' | +| Delegated (work or school account) | Machine.Read | 'Read machine information' | +| Delegated (work or school account) | Macine.ReadWrite | 'Read and write machine information' | ++## HTTP request ++```http +GET /api/public/avdeviceshealth +``` ++## Request headers ++| Name | Type | Description | +|:-|:-|:-| +| Authorization | String | Bearer {token}. **Required** | ++## Request body ++_Empty_ ++## Response ++If successful, this method returns 200 OK with a list of device health details. ++## Example ++### Example request ++Here is an example of the request: ++```http +GET https://api.securitycenter.microsoft.com/api/public/avdeviceshealth +``` ++### Example response ++Here is an example of the response: ++```json +{ ++ "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#avdeviceshealth", ++ "value": [ ++ { ++ "id": "sampleId", ++ "machineId": "sampleMachineId", ++ "computerDnsName": "sampleDnsName", ++ "osKind": "mac", ++ "osPlatform": "macOS", ++ "osVersion": "11.6.5.0", ++ "avMode": "0", ++ "avSignatureVersion": "87523", ++ "avEngineVersion": "3.0", ++ "avPlatformVersion": "101.61.69", ++ "lastSeenTime": "2022-04-02T06:12:07+00:00", ++ "quickScanResult": "-", ++ "quickScanError": "-", ++ "fullScanResult": "-", ++ "fullScanError": "-", ++ "dataRefreshTimestamp": "2022-04-06T21:50:48+00:00", ++ "avSignatureUpdateTime": "2022-04-01T01:31:58+00:00", ++ "avIsSignatureUpToDate": "Unknown", ++ "avIsEngineUpToDate": "Unknown", ++ "avIsPlatformUpToDate": "Unknown", ++ "rbacGroupId": 86 ++ }, ++ ... ++ ] ++} +``` ++## See also ++[Device health and compliance report in Microsoft Defender for Endpoint](machine-reports.md) |
| security | Device Health Export Antivirus Health Report Api | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-health-export-antivirus-health-report-api.md | + + Title: Microsoft Defender Antivirus Device Health export device antivirus health reporting +description: Presents methods to retrieve Microsoft Defender Antivirus (MDAV) device health details. +keywords: apis, graph api, supported apis, get, device health api, Microsoft Defender for Endpoint report api microsoft defender reports api, microsoft defender for endpoint reporting api, windows defender reporting api, defender for endpoint reporting api, windows defender report api +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro +++MS.technology: mde ++++# Export device antivirus health report +++**Applies to:** ++- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ++> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) +++++This API has two methods to retrieve Microsoft Defender Antivirus device antivirus health details: ++- **Method one:** [1 Export health reporting \(**JSON response**\)](#1-export-health-reporting-json-response) The method pulls all data in your organization as JSON responses. This method is best for _small organizations with less than 100-K devices_. The response is paginated, so you can use the \@odata.nextLink field from the response to fetch the next results. ++- **Method two:** [2 Export health reporting \(**via files**\)](#2-export-health-reporting-via-files) This method enables pulling larger amounts of data faster and more reliably. So, it's recommended for large organizations, with more than 100-K devices. This API pulls all data in your organization as download files. The response contains URLs to download all the data from Azure Storage. This API enables you to download all your data from Azure Storage as follows: + - Call the API to get a list of download URLs with all your organization data. + - Download all the files using the download URLs and process the data as you like. ++Data that is collected using either '_JSON response_ or _via files_' is the current snapshot of the current state. It doesn't contain historic data. To collect historic data, customers must save the data in their own data storages. See [Export device health details API methods and properties](device-health-api-methods-properties.md). ++> [!IMPORTANT] +> +> For Windows Server 2012 R2 and Windows Server 2016 to appear in device health reports, these devices must be onboarded using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016](/microsoft-365/security/defender-endpoint/configure-server-endpoints#new-windows-server-2012-r2-and-2016-functionality-in-the-modern-unified-solution). ++> [!NOTE] +> +> For information about using the **Device health and antivirus compliance** reporting tool in the Microsoft 365 Security dashboard, see: [Device health and antivirus compliance report in Microsoft Defender for Endpoint](machine-reports.md). +> ++## 1 Export health reporting (JSON response) ++### 1.1 API method description ++This API retrieves a list of Microsoft Defender Antivirus device antivirus health details. Returns a table with an entry for every unique combination of: ++- DeviceId +- Device name +- AV mode +- Up-to-date status +- Scan results ++#### 1.1.1 Limitations ++- maximum page size is 200,000 +- Rate limitations for this API are (**_example_** 30 calls per minute and 1000 calls per hour._) ++#### OData supported operators ++- ```$filter```  on: ```machineId```, ```computerDnsName```, ```osKind```, ```osPlatform```, ```osVersion```, ```avMode```, ```avSignatureVersion```, ```avEngineVersion```, ```avPlatformVersion```, ```quickScanResult```, ```quickScanError```, ```fullScanResult```, ```fullScanError```, ```avIsSignatureUpToDate```, ```avIsEngineUpToDate```, ```avIsPlatformUpToDate```, ```rbacGroupId``` +- ```$top```  with max value of 10,000. +- ```$skip```. ++### 1.2 Permissions ++One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Use Microsoft Defender for Endpoint APIs for details. ++| Permission type | Permission | Permission display name | +|:|:|:| +| Application | Machine.Read.All | ‘Read all machine profiles’ | +| Application | Machine.ReadWrite.All | ‘Read and write all machine information’ | +|Delegated (work or school account) | Machine.Read | ‘Read machine information’ | +| Delegated (work or school account) | Machine.ReadWrite | ‘Read and write machine information’ | ++### 1.3 URL (HTTP request) ++```http +URL: GET: /api/deviceavinfo +``` ++#### 1.3.1 Request headers ++| Name | Type | Description | +|:|:|:| +| Authorization | String | Bearer {token}. Required. | ++#### 1.3.2 Request body ++Empty ++#### 1.3.3 Response ++If successful, this method returns 200 OK with a list of device health details. ++### 1.4 Parameters ++- Default page size is 20 +- See examples at [OData queries with Microsoft Defender for Endpoint](exposed-apis-odata-samples.md). ++### 1.5 Properties ++See: [1.2 Export device antivirus health details API properties (JSON response)](device-health-api-methods-properties.md#12-export-device-antivirus-health-details-api-properties-json-response) ++Supports [OData V4 queries](https://www.odata.org/documentation/). ++### 1.6 Example ++#### Request example ++Here's an example request: ++```http +GET https://api.securitycenter.microsoft.com/api/deviceavinfo +``` ++#### Response example ++Here's an example response: ++```json +{ ++ @odata.context: "https://api.securitycenter.microsoft.com/api/$metadata#DeviceAvInfo", ++"value": [{ ++ "id": "Sample Guid", ++ "machineId": "Sample Machine Guid", ++ "computerDnsName": "appblockstg1", ++ "osKind": "windows", ++ "osPlatform": "Windows10", ++ "osVersion": "10.0.19044.1865", ++ "avMode": "0", ++ "avSignatureVersion": "1.371.1279.0", ++ "avEngineVersion": "1.1.19428.0", ++ "avPlatformVersion": "4.18.2206.108", ++ "lastSeenTime": "2022-08-02T19:40:45Z", ++ "quickScanResult": "Completed", ++ "quickScanError": "", ++ "quickScanTime": "2022-08-02T18:40:15.882Z", ++ "fullScanResult": "", ++ "fullScanError": "", ++ "fullScanTime": null, ++ "dataRefreshTimestamp": "2022-08-02T21:16:23Z", ++ "avEngineUpdateTime": "2022-08-02T00:03:39Z", ++ "avSignatureUpdateTime": "2022-08-02T00:03:39Z", ++ "avPlatformUpdateTime": "2022-06-20T16:59:35Z", ++ "avIsSignatureUpToDate": "True", ++ "avIsEngineUpToDate": "True", ++ "avIsPlatformUpToDate": "True", ++ "avSignaturePublishTime": "2022-08-02T00:03:39Z", ++ "rbacGroupName": "TVM1", ++ "rbacGroupId": 4415 ++ }, ++ ... ++ ] ++} +``` ++## 2 Export health reporting (via files) ++### 2.1 API method description ++This API response contains all the data of Antivirus health and status per device. Returns a table with an entry for every unique combination of: ++- DeviceId +- device name +- AV mode +- Up-to-date status +- Scan results ++#### 2.1.2 Limitations ++- Maximum page size is 200,000. +- Rate limitations for this API are 30 calls per minute and 1000 calls per hour. ++### 2.2 Permissions ++One of the following permissions is required to call this API. ++| Permission type | Permission | Permission display name | +|:|:|:| +| Application | Machine.ReadWrite.All | ' Read and write all machine information’ | +| Delegated (work or school account) | Machine.Read | ' Read machine information ' | ++To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs for details](apis-intro.md). ++### 2.3 URL ++```http +GET /api/machines/InfoGatheringExport +``` ++### 2.4 Parameters ++- ```sasValidHours```: The number of hours that the download URLs will be valid for (Maximum 24 hours). ++### 2.5 Properties ++See: [1.3 Export device antivirus health details API properties \(via files\)](device-health-api-methods-properties.md#13-export-device-antivirus-health-details-api-properties-via-files). ++### 2.6 Examples ++#### 2.6.1 Request example ++Here's an example request: ++```HTTP +GET https://api-us.securitycenter.contoso.com/api/machines/InfoGatheringExport +``` ++#### 2.6.2 Response example ++Here's an example response: ++```json +{ ++ "@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#microsoft.windowsDefenderATP.api.ExportFilesResponse", ++ "exportFiles": [ ++ "https://tvmexportexternalprdeus.blob.core.windows.net/temp-../2022-08-02/2201/InfoGatheringExport/json/OrgId=../_RbacGroupId=../part-00055-12fc2fcd-8f56-4e09-934f-e8efe7ce74a0.c000.json.gz?sv=2020-08-04&st=2022-08-02T22%3A47%3A11Z&se=2022-08-03T01%3A47%3A11Z&sr=b&sp=r&sig=..", ++ "https://tvmexportexternalprdeus.blob.core.windows.net/temp-../2022-08-02/2201/InfoGatheringExport/json/OrgId=../_RbacGroupId=../part-00055-12fc2fcd-8f56-4e09-934f-e8efe7ce74a0.c000.json.gz?sv=2020-08-04&st=2022-08-02T22%3A47%3A11Z&se=2022-08-03T01%3A47%3A11Z&sr=b&sp=r&sig=.." ++ ], +++ "generatedTime": "2022-08-02T22:01:00Z" +++} +``` ++## See also ++[Export device health methods and properties](device-health-api-methods-properties.md) ++[Device health and compliance reporting](machine-reports.md) |
| security | Edr In Block Mode | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/edr-in-block-mode.md | ms.localizationpriority: medium - next-gen - edr++ - m365-security-compliance + - m365initiative-defender-endpoint - admindeeplinkDEFENDER Previously updated : 04/04/2022- Last updated : 08/08/2022 ms.technology: mde ms.technology: mde ## What is EDR in block mode? -[Endpoint detection and response](overview-endpoint-detection-response.md) (EDR) in block mode provides added protection from malicious artifacts when Microsoft Defender Antivirus is not the primary antivirus product and is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts that were detected by EDR capabilities. Such artifacts might have been missed by the primary, non-Microsoft antivirus product. For devices running Microsoft Defender Antivirus as their primary antivirus, EDR in block mode provides an extra layer of defense by allowing Microsoft Defender Antivirus to take automatic actions on post-breach, behavioral EDR detections. +[Endpoint detection and response](overview-endpoint-detection-response.md) (EDR) in block mode provides added protection from malicious artifacts when Microsoft Defender Antivirus(MDAV) is not the primary antivirus product and is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts that were detected by EDR capabilities. Such artifacts might have been missed by the primary, non-Microsoft antivirus product. EDR in block mode allows Microsoft Defender Antivirus to take actions on post-breach, behavioral EDR detections. See the section, [Do I need to turn on EDR in block mode if I have Microsoft Defender Antivirus?](#do-i-need-to-turn-edr-in-block-mode-on-if-i-have-microsoft-defender-antivirus-running-on-devices) in the **Frequently asked questions** section. > [!IMPORTANT]-> EDR in block mode does not provide all the protection that is available when Microsoft Defender Antivirus real-time protection is enabled. All features that depend on Microsoft Defender Antivirus to be the active antivirus solution will not work, including the following key examples: -> +> EDR in block mode does not provide all the protection that is available when Microsoft Defender Antivirus real-time protection is enabled. Some capabilities depend on Microsoft Defender Antivirus to be the active antivirus solution, such as the following examples: > - Real-time protection, including on-access scanning, is not available when Microsoft Defender Antivirus is in passive mode. To learn more about real-time protection policy settings, see **[Enable and configure Microsoft Defender Antivirus always-on protection](configure-real-time-protection-microsoft-defender-antivirus.md)**.-> > - Features like **[network protection](network-protection.md)** and **[attack surface reduction rules](attack-surface-reduction.md)** are only available when Microsoft Defender Antivirus is running in active mode.-> -> It is expected that your non-Microsoft antivirus solution provides these capabilities. +> It is expected that your non-Microsoft antivirus solution includes these capabilities. -EDR in block mode is integrated with [threat & vulnerability management](next-gen-threat-and-vuln-mgt.md). Your organization's security team will get a [security recommendation](tvm-security-recommendation.md) to turn EDR in block mode on if it isn't already enabled. +EDR in block mode is integrated with [threat & vulnerability management](next-gen-threat-and-vuln-mgt.md) capabilities. Your organization's security team will get a [security recommendation](tvm-security-recommendation.md) to turn EDR in block mode on if it isn't already enabled. This recommendation is primarily for devices using an active non-Microsoft antivirus solution (with Microsoft Defender Antivirus in passive mode). There is little benefit to enabling EDR in block mode when Microsoft Defender Antivirus is the primary antivirus solution on devices. :::image type="content" source="images/edrblockmode-TVMrecommendation.png" alt-text="The recommendation to turn on EDR in block mode" lightbox="images/edrblockmode-TVMrecommendation.png"::: EDR in block mode is integrated with [threat & vulnerability management](next-ge > To get the best protection, make sure to **[deploy Microsoft Defender for Endpoint baselines](configure-machines-security-baseline.md)**. Watch this video to learn why and how to turn on endpoint detection and response (EDR) in block mode, enable behavioral blocking, and containment at every stage from pre-breach to post-breach. + > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4HjW2] ## What happens when something is detected? -When EDR in block mode is turned on, and a malicious artifact is detected, Microsoft Defender for Endpoint blocks and remediates that artifact. Your security operations team will see detection status as **Blocked** or **Prevented** in the [Action center](respond-machine-alerts.md#check-activity-details-in-action-center), listed as completed actions. --The following image shows an instance of unwanted software that was detected and blocked through EDR in block mode: -+When EDR in block mode is turned on, and a malicious artifact is detected, Defender for Endpoint remediates that artifact. Your security operations team will see detection status as **Blocked** or **Prevented** in the [Action center](respond-machine-alerts.md#check-activity-details-in-action-center), listed as completed actions. The following image shows an instance of unwanted software that was detected and remediated through EDR in block mode: ## Enable EDR in block mode The following image shows an instance of unwanted software that was detected and To create a custom policy in Intune, see [Deploy OMA-URIs to target a CSP through Intune, and a comparison to on-premises](/troubleshoot/mem/intune/deploy-oma-uris-to-target-csp-via-intune). -For more information on the Defender CSP used for EDR in block mode, see "Configuration/PassiveRemediation" under [Defender CSP](/windows/client-management/mdm/defender-csp). -+For more information on the Defender CSP used for EDR in bloc ## Requirements for EDR in block mode The following table lists requirements for EDR in block mode: |Requirement|Details| ||| |Permissions|You must have either the Global Administrator or Security Administrator role assigned in [Azure Active Directory](/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal). For more information, see [Basic permissions](basic-permissions.md).|-|Operating system|Devices must be running one of the following versions of Windows: <br/>- Windows 11 <br/>- Windows 10 (all releases)<br/>- Windows Server 2022 <br/>- Windows Server 2019<br/>- Windows Server, version 1803 or newer<br/>- Windows Server 2016 and Windows Server 2012 R2 (with the [new unified client solution](configure-server-endpoints.md#new-windows-server-2012-r2-and-2016-functionality-in-the-modern-unified-solution))<sup>[[1](#fn1)]</sup> | -|Microsoft Defender for Endpoint|Devices must be onboarded to Defender for Endpoint. See the following articles: <br/>- [Minimum requirements for Microsoft Defender for Endpoint](minimum-requirements.md)<br/>- [Onboard devices and configure Microsoft Defender for Endpoint capabilities](onboard-configure.md)<br/>- [Onboard Windows servers to the Defender for Endpoint service](configure-server-endpoints.md)<br/>- [New Windows Server 2012 R2 and 2016 functionality in the modern unified solution (Preview)](configure-server-endpoints.md#new-windows-server-2012-r2-and-2016-functionality-in-the-modern-unified-solution) | +|Operating system|Devices must be running one of the following versions of Windows: <ul><li>Windows 11</li><li>Windows 10 (all releases)</li><li>Windows Server 2019 or later</li><li>Windows Server, version 1803 or later</li><li>Windows Server 2016 (only when Microsoft Defender Antivirus is in active mode)</li></ul>| +|Microsoft Defender for Endpoint|Devices must be onboarded to Defender for Endpoint. See [Minimum requirements for Microsoft Defender for Endpoint](minimum-requirements.md).| |Microsoft Defender Antivirus|Devices must have Microsoft Defender Antivirus installed and running in either active mode or passive mode. [Confirm Microsoft Defender Antivirus is in active or passive mode](#how-do-i-confirm-microsoft-defender-antivirus-is-in-active-or-passive-mode).| |Cloud-delivered protection|Microsoft Defender Antivirus must be configured such that [cloud-delivered protection is enabled](enable-cloud-protection-microsoft-defender-antivirus.md).| |Microsoft Defender Antivirus platform|Devices must be up to date. To confirm, using PowerShell, run the [Get-MpComputerStatus](/powershell/module/defender/get-mpcomputerstatus) cmdlet as an administrator. In the **AMProductVersion** line, you should see **4.18.2001.10** or above. <p> To learn more, see [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).| |
| security | Exposed Apis List | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/exposed-apis-list.md | Learn more about the individual supported entities where you can run API calls t Topic | Description :|:-[Advanced Hunting](run-advanced-query-api.md) | Run queries from API.<p>*Advanced hunting capabilities are not included in [Defender for Business](../defender-business/mdb-overview.md)*. -[Alert methods and properties](alerts.md) | Run API calls such as \- get alerts, create alert, update alert and more. -[Export assessment methods and properties per device](get-assessment-methods-properties.md) | Run API calls to gather vulnerability assessments on a per-device basis, such as: \- export secure configuration assessment, export software inventory assessment, export software vulnerabilities assessment, and delta export software vulnerabilities assessment. -[Automated Investigation methods and properties](investigation.md) | Run API calls such as \- get collection of Investigation. -[Get domain related alerts](get-domain-related-alerts.md) | Run API calls such as \- get domain-related devices, domain statistics and more. -[File methods and properties](files.md) | Run API calls such as \- get file information, file related alerts, file related devices, and file statistics. -[Indicators methods and properties](ti-indicator.md) | Run API call such as \- get Indicators, create Indicator, and delete Indicators. -[Get IP related alerts](get-ip-related-alerts.md) | Run API calls such as \- get IP-related alerts and get IP statistics. -[Machine methods and properties](machine.md) | Run API calls such as \- get devices, get devices by ID, information about logged on users, edit tags and more. -[Machine Action methods and properties](machineaction.md) | Run API call such as \- Isolation, Run anti-virus scan and more. -[Recommendation methods and properties](recommendation.md) | Run API calls such as \- get recommendation by ID. -[Remediation activity methods and properties](get-remediation-methods-properties.md) | Run API call such as \- get all remediation tasks, get exposed devices remediation task and get one remediation task by id. -[Score methods and properties](score.md) | Run API calls such as \- get exposure score or get device secure score. -[Software methods and properties](software.md) | Run API calls such as \- list vulnerabilities by software. -[User methods](user.md) | Run API calls such as \- get user-related alerts and user-related devices. -[Vulnerability methods and properties](vulnerability.md) | Run API calls such as \- list devices by vulnerability. +[**Advanced Hunting** methods](run-advanced-query-api.md) | Run queries from API. +[**Alert** methods and properties](alerts.md) | Run API calls such as \- get alerts, create alert, update alert and more. +[Export **Assessment** per-device methods and properties](get-assessment-methods-properties.md) | Run API calls to gather vulnerability assessments on a per-device basis, such as: \- export secure configuration assessment, export software inventory assessment, export software vulnerabilities assessment, and delta export software vulnerabilities assessment. +[**Automated investigation** methods and properties](investigation.md) | Run API calls such as \- get collection of Investigation. +[Export device health methods and properties](device-health-api-methods-properties.md) | Run API Calls such as - GET /api/public/avdeviceshealth. +[**Domain**-related alerts](get-domain-related-alerts.md) | Run API calls such as \- get domain-related devices, domain statistics and more. +[**File** methods and properties](files.md) | Run API calls such as \- get file information, file related alerts, file related devices, and file statistics. +[**Indicators** methods and properties](ti-indicator.md) | Run API call such as \- get Indicators, create Indicator, and delete Indicators. +[**IP**-related alerts](get-ip-related-alerts.md) | Run API calls such as \- get IP-related alerts and get IP statistics. +[**Machine** methods and properties](machine.md) | Run API calls such as \- get devices, get devices by ID, information about logged on users, edit tags and more. +[**Machine Action** methods and properties](machineaction.md) | Run API call such as \- Isolation, Run anti-virus scan and more. +[**Recommendation** methods and properties](recommendation.md) | Run API calls such as \- get recommendation by ID. +[**Remediation activity** methods and properties](get-remediation-methods-properties.md) | Run API call such as \- get all remediation tasks, get exposed devices remediation task and get one remediation task by id. +[**Score** methods and properties](score.md) | Run API calls such as \- get exposure score or get device secure score. +[**Software** methods and properties](software.md) | Run API calls such as \- list vulnerabilities by software. +[**User** methods and properties](user.md) | Run API calls such as \- get user-related alerts and user-related devices. +[**Vulnerability** methods and properties](vulnerability.md) | Run API calls such as \- list devices by vulnerability. ## See also |
| security | Get Assessment Software Vulnerabilities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-assessment-software-vulnerabilities.md | GET /api/machines/SoftwareVulnerabilitiesByMachine <br> -**** - Property (ID)|Data type|Description|Example of a returned value :|:|:|: CveId|String|Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system.|CVE-2020-15992 |
| security | Gov | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/gov.md | Microsoft Defender for Endpoint for US Government customers requires one of the |Microsoft 365 G5 Security GCC|Microsoft 365 G5 Security for GCC High|Microsoft 365 G5 Security for DOD| |Microsoft Defender for Endpoint - GCC|Microsoft Defender for Endpoint for GCC High|Microsoft Defender for Endpoint for DOD| |Windows 10 Enterprise E5 GCC|Windows 10 Enterprise E5 for GCC High|Windows 10 Enterprise E5 for DOD|-| ### Server licensing Microsoft Defender for Endpoint for US Government customers requires one of the |||| |Microsoft Defender for Endpoint Server GCC|Microsoft Defender for Endpoint Server for GCC High|Microsoft Defender for Endpoint Server for DOD| |Microsoft Defender for servers|Microsoft Defender for servers - Government|Microsoft Defender for servers - Government|-| ## Portal URLs The following are the Microsoft Defender for Endpoint portal URLs for US Governm |GCC|<https://security.microsoft.com>| |GCC High|<https://security.microsoft.us>| |DoD|<https://security.apps.mil>|-| + > [!NOTE] > If you are a GCC customer and in the process of moving from Microsoft Defender for Endpoint commercial to GCC, use https://transition.security.microsoft.com to access your Microsoft Defender for Endpoint commercial data. Linux||||| Android| <br /> | <br /> | <br /> iOS| <br /> | <br /> | <br /> -| > [!NOTE] > <sup>1</sup> The patch must be deployed prior to device onboarding in order to configure Defender for Endpoint to the correct environment. Windows Server 2019|||| Windows Server 2012 R2||| Windows Server 2008 R2 SP1|||-| ## Required connectivity settings Instead of the public URIs listed in our [API documentation](apis-intro.md), you |||| |Login|`https://login.microsoftonline.com`|`https://login.microsoftonline.us`| |Defender for Endpoint API|`https://api-gcc.securitycenter.microsoft.us`|`https://api-gov.securitycenter.microsoft.us`|-|SIEM|`https://wdatp-alertexporter-us.gcc.securitycenter.windows.us`|`https://wdatp-alertexporter-us.securitycenter.windows.us`| -| ## Feature parity with commercial These are the known gaps: |Feature name|GCC|GCC High|DoD| ||::|::|::|-|Network assessments| In development| In development| In development| -|Network discovery|||| -|Reports: Device Control, Device health, Firewall| In development| In development| In development| -|Web content filtering| In development| In development| In development| -|Microsoft Secure Score| <sup>1</sup>| Not supported| Not supported| +|Reports: Device health| In development| In development| In development| +|Reports: Web content filtering|| In development| In development| +|Microsoft Secure Score| <sup>1</sup>||| |Microsoft Threat Experts|||| > [!NOTE] > <sup>1</sup> While Microsoft Secure Score is available for GCC customers, there are some security recommendations that aren't available. |
| security | Machine Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/machine-reports.md | Title: Device health and compliance report in Microsoft Defender for Endpoint -description: Track device health state detections, antivirus status, OS platform, and Windows 10 versions using the device health and compliance report +description: Use the device health and compliance report to track device health, antivirus status and versions, OS platforms, and Windows 10 versions. keywords: health state, antivirus, os platform, windows 10 version, version, health, compliance, state+search.product: eADQiWindows 10XVcnh +search.appverid: met150 ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security--+++localization_priority: Normal Last updated : 08/08/2022 audience: ITPro ms.technology: mde # Device health and compliance report in Microsoft Defender for Endpoint -- **Applies to:**-- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)++- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)-- Microsoft Defender Antivirus -**Platforms** -- Windows-- Mac OS-- Linux-- iOS-- Android+> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) -Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) +> [!IMPORTANT] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Information about the features that are _commercially released_ follows the prerelease information in the section titled [Publicly-released: Device health and compliance report in Microsoft Defender for Endpoint](#publicly-released-device-health-and-compliance-report-in-microsoft-defender-for-endpoint). -The devices status report provides high-level information about the devices in your organization. The report includes trending information showing the sensor health state, antivirus status, OS platforms, and Windows 10 (and Windows 11) versions. +## Public Preview - Device health and antivirus compliance report in Microsoft Defender for Endpoint -The dashboard is structured into two sections: +The devices status report provides high-level information about the devices in your organization. The report includes trending information showing the sensor health state, antivirus status, OS platforms, and Windows 10 versions. ++> [!IMPORTANT] +> For Windows Server 2012 R2 and Windows Server 2016 to appear in device health reports, these devices must be onboarded using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016](/microsoft-365/security/defender-endpoint/configure-server-endpoints#new-windows-server-2012-r2-and-2016-functionality-in-the-modern-unified-solution). ++In the Microsoft 365 Security dashboard navigation panel, select **Reports**, and then open **Device health and compliance**. +The Device health and compliance dashboard is structured in two tabs: ++- The [**Sensor health & OS** tab](#sensor-health--os-tab) provides general operating system information, divided into three cards that display the following device attributes: + - [Sensor health card](#sensor-health-card) + - [Operating systems and platforms card](#operating-systems-and-platforms-card) + - [Windows 10 versions card](#windows-10-versions-card) ++- The [**Microsoft Defender Antivirus health** tab](#microsoft-defender-antivirus-health-tab) has eight cards that report on aspects of Microsoft Defender Antivirus: + - [Antivirus mode card](#antivirus-mode-card) + - [Antivirus engine version card](#antivirus-engine-version-card) + - [Antivirus security intelligence version card](#antivirus-security-intelligence-version-card) + - [Antivirus platform version card](#antivirus-platform-version-card) + - [Recent antivirus scan results card](#recent-antivirus-scan-results-card) + - [Antivirus engine updates card](#antivirus-engine-updates-card) + - [Security intelligence updates card](#security-intelligence-updates-card) + - [Antivirus platform updates card](#antivirus-platform-updates-card) ++### Sensor health & OS tab ++Sensor health and OS cards report on general operating system health, which includes detection sensor health, up-to-date versus out-of-date operating systems, and Windows 10 versions. ++> [!div class="mx-imgBorder"] +>  ++Each of the three cards on the **Sensor health** tab have two reporting sections, _Current state_ and _device trends_, presented as graphs: ++#### Current state graph ++In each card, the Current state (referred to in some documentation as _Device summary_) is the top, horizontal bar graph. Current state is a snapshot that shows information collected about devices in your organization, scoped to the current day. This graph represents the distribution of devices across your organization that report status or are detected to be in a specific state. ++> [!div class="mx-imgBorder"] +>  ++#### Device trends graph ++The lower graph on each of the three cards isn't named, but is commonly known as _device trends_. The device trends graph depicts the collection of devices across your organization, throughout the time span indicated directly above the graph. +By default, the device trends graph displays device information from the 30-day period, ending in the latest full day. To gain a better perspective about trends occurring in your organization, you can fine-tune the reporting period by adjusting the time period shown. To adjust the time period, open the filter and select a start day and end day. ++> [!div class="mx-imgBorder"] +>  ++#### Filtering data ++Use the provided filters to include or exclude devices with certain attributes. You can select multiple filters to apply from the device attributes. When applied, filters apply to all three cards in the report. ++For example, to show data about Windows 10 devices with Active sensor health state: ++1. Under **Filters** > **Sensor health state** > **Active**. +2. Then select **OS platforms** > **Windows 10**. +3. Select **Apply**. ++#### Sensor health card ++The Sensor health card displays information about the sensor state on devices. Sensor health provides an aggregate view of devices that are: ++- active +- inactive +- experiencing impaired communications +- or where no sensor data is reported ++Devices that are either experiencing impaired communications, or devices from which no sensor data is detected could expose your organization to risks, and warrant investigation. Likewise, devices that are inactive for extended periods of time could expose your organization to threats due to out-of-date software. Devices that are inactive for long periods of time also warrant investigation. ++#### Operating systems and platforms card ++This card shows the distribution of operating systems and platforms that exist within your organization. +_OS systems and platforms_ can give useful insights into whether devices in your organization are running current or outdated operating systems. When new operating systems are introduced, security enhancements are frequently included that improve your organization's posture against security threats. ++For example, Secure Boot, introduced in Windows 8, practically eliminated the threat from some of the most harmful types of malware. Improvements in Windows 10 provide PC manufacturers the option to prevent users from disabling the Secure Boot feature. Preventing users from disabling the Secure Boot feature removes almost any chance of malicious rootkits or other low-level malware from infecting the boot process. +Ideally, the ΓÇ£Current stateΓÇ¥ graph shows that the number of operating systems is weighted in favor of more current OS over older versions. Otherwise, the trends graph indicates that new systems are being adopted and/or older systems are being updated or replaced. ++#### Windows 10 versions card ++The card shows the distribution of Windows devices and their versions in your organization. +In the same way that an upgrade from Windows 8 to Windows 10 improves security in your organization, changing from early releases of Windows to more current versions improves your posture against possible threats. ++The Windows version trend graph can help you quickly determine whether your organization is keeping current by updating to the most recent, most secure versions of Windows 10. ++### Microsoft Defender Antivirus health tab ++The Microsoft Defender Antivirus health tab contains eight cards that report on several aspects of Microsoft Defender Antivirus in your organization: ++Two cards, [Antivirus mode card](#antivirus-mode-card) and [Recent antivirus scan results card](#recent-antivirus-scan-results-card), report about Microsoft Defender Antivirus functions. ++The remaining six cards report about the Microsoft Defender Antivirus status for devices in your organization: ++| _version_ cards: | _update_ cards{<a id="fn1">1</a>} | +|:|:| +| [Antivirus engine version card](#antivirus-engine-version-card) <br> [Antivirus security intelligence version card](#antivirus-security-intelligence-version-card) <br> [Antivirus platform version card](#antivirus-platform-version-card) | [Antivirus engine updates card](#antivirus-engine-updates-card) <br> [Security intelligence updates card](#security-intelligence-updates-card) <br> [Antivirus platform updates card](#antivirus-platform-updates-card) | +| The three update cards provide links to additional resources to learn more. | The three version cards provide flyout reports that provide additional information, and enable further exploration. | ++<sup>{[1](#fn1)}</sup> For the three _updates_ cards, "**No data available**" indicates devices that aren't reporting update status. Devices that aren't reporting update status can be due to various reasons, such as: ++- Computer is disconnected from the network +- Computer is powered down or in a hibernation state +- Microsoft Defender Antivirus is disabled +- Device is a non-Windows (Mac or Linux) device +- Cloud protection is not enabled ++> [!NOTE] +> Currently, "Up-to-date" reporting is only available for Windows devices. Up-to-date reporting generates information about Windows devices with cloud protection enabled and engine version: 1.1.19300.2 and newer. Cross-platform devices, such as Mac and Linux, are listed under "no data available." ++> [!div class="mx-imgBorder"] +>  ++#### Card functionality ++The functionality is essentially the same for all cards. By clicking on a numbered bar in any of the cards, the **Microsoft Defender Antivirus details** flyout opens enabling you to review information about all the devices configured with the version number of an aspect on that card. ++> [!div class="mx-imgBorder"] +>  ++If the version number that you clicked on is: ++- A current version, then **Remediation required** and **Security recommendation** aren't present +- An outdated version, a notification at the top of the report is present, indicating **Remediation required**, and a **Security recommendation** link is present. Select the security recommendation link to navigate to the threat and vulnerability management console, which can recommend appropriate antivirus updates. ++To add or remove specific types of information on the **Microsoft Defender Antivirus details** flyout, click **Customize Columns**. In **Customize Columns**, select or clear items to specify what you want included in the Microsoft Defender Antivirus details report. ++> [!div class="mx-imgBorder"] +>  ++Within the flyout: clicking on the name of the device will redirect you to the "Device page" for that device, where you can access detailed reports. +You can use the **Export** button within the _Microsoft Defender Antivirus details_ flyout to export a report to an Excel spreadsheet. Exported reports capture information based on your entry-point into the details report and which filters or customized columns you have set. +For additional information on exporting using API, see the following articles: -<br> +- [Export device antivirus health report](device-health-export-antivirus-health-report-api.md) +- [Export device antivirus health details API methods and properties](device-health-api-methods-properties.md) -**** +#### Microsoft Defender Antivirus version and update cards functionality ++Following are descriptions for the six cards that report about the _version_ and _update_ information for Microsoft Defender Antivirus engine, security intelligence, and platform components: ++##### Full report ++In any of the three _version_ cards, click **View full report** to display the nine most recent Microsoft Defender Antivirus _version_ reports for each of the three device types: Windows, Mac, and Linux; if fewer than nine exist, they're all shown. An **Other** category captures recent antivirus engine versions ranking tenth and below, if detected. ++> [!div class="mx-imgBorder"] +>  ++A primary benefit of the three _version_ cards is that they provide quick indicators as to whether the most current versions of the antivirus engines, platforms, and security intelligence are being utilized. Coupled with the detailed information that is linked to the card, the versions cards become a powerful tool to check if versions are up to date and to gather information about individual computers, or groups of computers. +Ideally, when you run these reports, they'll indicate that the most current antivirus versions are installed, as opposed to older versions. +Use these reports to determine whether your organization is taking full advantage of the most current versions. ++> [!div class="mx-imgBorder"] +>  ++To help ensure your anti-malware solution detects the latest threats, get updates automatically as part of Windows Update. ++For more details on the current versions and how to update the different Microsoft Defender Antivirus components, visit [Microsoft Defender Antivirus platform support](manage-updates-baselines-microsoft-defender-antivirus.md). ++#### Card descriptions ++Following are brief summaries of the collected information reported in each of the _Antivirus version_ cards: ++##### Antivirus mode card ++Reports on how many devices in your organization ΓÇô on the date indicated on the card ΓÇô are in any of the following Microsoft Defender Antivirus modes: ++| value | mode | +||| +| 0 | Active | +| 1 | Passive | +| 2 | Disabled (uninstalled, disabled, or SideBySidePassive {also known as Low Periodic Scan}) | +| 3 | Others (Not running, Unknown) | +| 4 | EDRBlocked | ++> [!div class="mx-imgBorder"] +>  ++Following are descriptions for each mode: ++- **Active** mode - In active mode, Microsoft Defender Antivirus is used as the primary antivirus app on the device. Files are scanned, threats are remediated, and detected threats are listed in your organization's security reports and in your Windows Security app. +- **Passive** mode - In passive mode, Microsoft Defender Antivirus isn't used as the primary antivirus app on the device. Files are scanned, and detected threats are reported, but threats aren't remediated by Microsoft Defender Antivirus. IMPORTANT: Microsoft Defender Antivirus can run in passive mode only on endpoints that are onboarded to Microsoft Defender for Endpoint. See [Requirements for Microsoft Defender Antivirus to run in passive mode](microsoft-defender-antivirus-compatibility.md#requirements-for-microsoft-defender-antivirus-to-run-in-passive-mode). +- **Disabled** mode - synonymous with: uninstalled, disabled, sideBySidePassive, and Low Periodic Scan. When disabled, Microsoft Defender Antivirus isn't used. Files aren't scanned, and threats aren't remediated. In general, Microsoft doesn't recommend disabling or uninstalling Microsoft Defender Antivirus. +- **Others** mode - Not running, Unknown +- **EDR in Block** mode - In endpoint detection and response (EDR) blocked mode. See [Endpoint detection and response in block mode](edr-in-block-mode.md) ++Devices that are in either passive, LPS, or Off present a potential security risk and should be investigated. ++For details about LPS, see [Use limited periodic scanning in Microsoft Defender Antivirus](limited-periodic-scanning-microsoft-defender-antivirus.md). ++##### Recent antivirus scan results card ++This card has two bars graphs showing all-up results for quick scans and full scans. In both graphs, the first bar indicates the completion rate for scans, and indicate **Completed**, **Canceled**, or **Failed**. The second bar in each section provides the error codes for failed scans. +By scanning the **Mode** and **Recent scan results** columns, you can quickly identify devices that aren't in active antivirus scan mode, and devices that have failed or canceled recent antivirus scans. You can return to the report with this information and gather more details and security recommendations. If any error codes are reported in this card, there will be a link to learn more about error codes. ++For more details on the current Microsoft Defender Antivirus versions and how to update the different Microsoft Defender Antivirus components, visit [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md). ++##### Antivirus engine version card ++Shows the real-time results of the most current Microsoft Defender Antivirus engine versions installed across Windows Devices, Mac devices, and Linux devices in your organization. Microsoft Defender Antivirus engine is updated monthly. +For more information on the current versions and how to update the different Microsoft Defender Antivirus components, see [Microsoft Defender Antivirus platform support](manage-updates-baselines-microsoft-defender-antivirus.md). ++##### Antivirus security intelligence version card ++Lists the most common _Microsoft Defender Antivirus security intelligence_ versions installed on devices on your network. +Microsoft continually updates Microsoft Defender security intelligence to address the latest threats, and to refine detection logic. These refinements to security intelligence enhance Microsoft Defender AntivirusΓÇÖ (and other Microsoft anti-malware solutionsΓÇÖ) ability to accurately identify potential threats. This security intelligence works directly with cloud-based protection to deliver AI-enhanced, next-generation protection that is fast and powerful. ++##### Antivirus platform version card ++Shows the real-time results of the most current Microsoft Defender Antivirus platform versions installed across versions of Windows, Mac, and Linux devices in your organization. Microsoft Defender Antivirus platform is updated monthly. +For more details on the current versions and how to update the different Microsoft Defender Antivirus components, see [Microsoft Defender Antivirus platform support](manage-updates-baselines-microsoft-defender-antivirus.md) ++##### Antivirus engine updates card ++This card identifies devices that have antivirus engine versions that are up to date versus out of date. +The general definition of ΓÇÿ_Up to date_ΓÇÖ ΓÇô the engine version on the device is the most recent engine release {the Engine is usually released monthly, via Windows Update (WU)}. There's a three-day grace period from the day when WU is released. ++| Microsoft considers devices with **Antivirus engine updates** that have: | to be: | +|:-|:-| +| Communicated to Defender in last 7 days with Signature Publish time within last 7 days _and have_ Engine or Platform version build time _within_ last 60 days | Up-to-date | +| Communicated to Defender in last 7 days with Signature Publish time within last 7 days but Engine or Platform version build time _older than_ 60 days | Out-of-date | +| Communicated to Defender in last 7 days with Signature Publish time _greater than_ days | No data available | +| NOT communicated to Defender in last 7 days and whose last status was "Up-to-date" | No data available | +| NOT communicated to Defender in last 7 days and whose last status was "Out-of-date" | No data available | ++##### Security intelligence updates card ++This card identifies devices that have security intelligence versions that are up to date versus out of date. +The general definition of ΓÇÿ**Up to date**ΓÇÖ ΓÇô the security intelligence version on the device was written in the past 7 days. ++| Microsoft considers devices with **Security Intelligence updates** that have: | to be: | +|:-|:-| +| A security intelligence version written in the past 7 days | Up-to-date | +| Communicated to Defender in last 7 days with Signature Publish time within last 7 days | Up-to-date | +| Communicated to Defender in last 7 days with Signature Publish time greater than last 7 days | Out-of-date | +| NOT communicated to Defender in last 7 days and whose last status was "Up-to-date" | No data available | +| NOT communicated to Defender in last 7 days and whose last status was Out-of-date | Out-of-date | ++##### Antivirus platform updates card ++This card identifies devices that have Antivirus platform versions that are up to date versus out of date. +The general definition of ΓÇÿ_Up to date_ΓÇÖ ΓÇô the platform version on the device is the most recent platform release (Platform is usually released monthly, via Windows Update). There's a three-day grace period from the day when WU is released. ++| Microsoft considers devices with **Antivirus platform updates** that have: | to be: | +|:-|:-| +| Communicated to Defender in last 7 days with Signature Publish time within last 7 days _and have_ Engine or Platform version build time _within_ last 60 days | Up-to-date | +| Communicated to Defender in last 7 days with Signature Publish time within last 7 days but Engine or Platform version build time _older than_ 60 days | Out-of-date | +| Communicated to Defender in last 7 days with Signature Publish time _greater than_ days | No data available | +| NOT communicated to Defender in last 7 days and whose last status was "Up-to-date" | No data available | +| NOT communicated to Defender in last 7 days and whose last status was "Out-of-date" | No data available | ++For information about Manage Microsoft Defender Antivirus update versions, see: [Monthly platform and engine versions](manage-updates-baselines-microsoft-defender-antivirus.md#monthly-platform-and-engine-versions) ++### See also ++- [Export device antivirus health details API methods and properties](device-health-api-methods-properties.md) +- [device-health-export-antivirus-health-report-api.md](device-health-api-methods-properties.md) +- [Threat protection report](threat-protection-reports.md) ++## Publicly released: Device health and compliance report in Microsoft Defender for Endpoint ++The device status report provides high-level information about the devices in your organization. The report includes trending information showing the sensor health state, antivirus status, OS platforms, and Windows 10 versions. ++The dashboard is structured into two sections: ++ |Section|Description| ||| |1|Device trends| |2|Device summary (current day)|-||| -## Device trends +### Device trends -By default, the device trends display device information from the 30-day period ending in the latest full day. To gain better perspective on trends occurring in your organization, you can fine-tune the reporting period by adjusting the time period shown. To adjust the time period, select a time range from the drop-down options: +By default, the device trends graph displays device information from the 30-day period ending in the latest full day. To gain better perspective on trends occurring in your organization, you can fine-tune the reporting period by adjusting the time period shown. To adjust the time period, select a time range from the drop-down options: - 30 days - Three months By default, the device trends display device information from the 30-day period > [!NOTE] > These filters are only applied on the device trends section. It doesn't affect the device summary section. -## Device summary +### Device summary -While the devices trends show trending device information, the device summary shows device information scoped to the current day. +Unlike the device trends graph, the device summary graph shows device information scoped to the current day. > [!NOTE] > The data reflected in the summary section is scoped to 180 days prior to the current date. For example if today's date is March 27, 2019, the data on the summary section will reflect numbers starting from September 28, 2018 to March 27, 2019.-> > The filter applied on the trends section is not applied on the summary section. The device trends section allows you to drill down to the devices list with the corresponding filter applied to it. For example, clicking on the Inactive bar in the Sensor health state card will bring you the devices list with results showing only devices whose sensor status is inactive. -## Device attributes +### Device attributes The report is made up of cards that display the following device attributes: -- **Health state**: shows information about the sensor state on devices, providing an aggregated view of devices that are active, experiencing impaired communications, inactive, or where no sensor data is seen.+- **Health state**: shows information about the sensor state on devices. This graph provides an all-up view of devices that are active, experiencing impaired communications, inactive, or where no sensor data is seen. - **Antivirus status for active Windows 10 devices**: shows the number of devices and status of Microsoft Defender Antivirus. - **OS platforms**: shows the distribution of OS platforms that exists within your organization. - **Windows 10 versions**: shows the distribution of Windows 10 devices and their versions in your organization. -## Filter data +### Filter data Use the provided filters to include or exclude devices with certain attributes. For example, to show data about Windows 10 devices with Active sensor health sta 2. Then select **OS platforms > Windows 10**. 3. Select **Apply**. +### Related articles ++- [Threat protection report](threat-protection-reports.md) + > [!TIP] > If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) For example, to show data about Windows 10 devices with Active sensor health sta > - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) > - [Configure Defender for Endpoint on Android features](android-configure.md) > - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md)--## Related topic --- [Threat protection report](threat-protection-reports.md) |
| security | Manage Updates Baselines Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus.md | ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: high Previously updated : 08/04/2022 Last updated : 08/08/2022 audience: ITPro -+ ms.technology: mde All our updates contain - Integration improvements (Cloud, [Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-defender)) <br/><br/> <details>+<summary>July-2022 (Platform: 4.18.2205.TBD | Engine: 1.1.19500.2)</summary> ++*This section contains pre-release information that is still in active development. Expect updates, including the final security update version number, to occur.* ++ Security intelligence update version: *coming soon*<br/> + Release date: **August 8, 2022**<br/> + Platform: *4.18.2205.TBD*<br/> + Engine: **1.1.19500.2**<br/> + Support phase: **Security and Critical Updates**<br/> ++Engine version: 1.1.19300.2<br/> +Security intelligence update version: *coming soon*<br/> ++### What's new ++- Performance improvement for [hybrid sleep](/windows-hardware/customize/power-settings/sleep-settings-hybrid-sleep) delay when Microsoft Defender Antivirus is active +- Fixed client detection behavior related to custom [certificate blocking indicators of compromise](indicator-certificates.md) +- Performance improvement for [AntiMalware Scan Interface (AMSI)](/windows/win32/amsi/antimalware-scan-interface-portal) caching +- Improved detection and remediation for [Microsoft Visual Basic for Applications](/office/vba/language/concepts/getting-started/64-bit-visual-basic-for-applications-overview) (VBA) related macros +- Improved processing of AMSI exclusions +- Fixed deadlock detection in Host Intrusion Prevention System (HIPS) rule processing. (For additional information about HIPS and Defender for Endpoint, see [Migrating from a third-party HIPS to ASR rules](migrating-asr-rules.md).) +- Fixed memory leak where `MsMpEng.exe` was consuming private bytes. (If high CPU usage is also an issue, see [High CPU usage due to Microsoft Defender Antivirus](troubleshooting-mode-scenarios.md)) +- Fixed deadlock with [behavior monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) +- Improved trust validation +- Fixed engine crash issue on legacy operating platforms +- Performance Analyzer v3 updates: Added top path support, scan skip information, and OnDemand scan support. See [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md). +++### Known Issues ++No known issues ++<br/><br/> +</details><details> <summary>May-2022 (Platform: 4.18.2205.7 | Engine: 1.1.19300.2)</summary>  Security intelligence update version: **1.369.88.0**<br/> Security intelligence update version: 1.361.1449.0<br/> - Potential for high resource utilization (CPU and/or memory). See the Platform 4.18.2203.5 and Engine 1.1.19200.5 update for March 2022. <br/><br/>-</details><details> +</details> +++### Previous version updates: Technical upgrade support only ++After a new package version is released, support for the previous two versions is reduced to technical support only. Versions older than that are listed in this section, and are provided for technical upgrade support only.<br/><br/> ++<details> <summary>February-2022 (Platform: 4.18.2202.4 | Engine: 1.1.19000.8)</summary>  Security intelligence update version: **1.361.14.0**<br/>  Released: **March 14, 2022**<br/>  Platform: **4.18.2202.4**<br/>  Engine: **1.1.19000.8**<br/>- Support phase: **Security and Critical Updates**<br/> + Support phase: **Technical upgrade support (only)**<br/> Engine version: 1.1.19000.8 <br/> Security intelligence update version: 1.361.14.0 <br/> Security intelligence update version: 1.361.14.0 <br/> No known issues <br/><br/>-</details> ---### Previous version updates: Technical upgrade support only --After a new package version is released, support for the previous two versions is reduced to technical support only. Versions older than that are listed in this section, and are provided for technical upgrade support only.<br/><br/> --<details> +</details><details> <summary>January-2022 (Platform: 4.18.2201.10 | Engine: 1.1.18900.2)</summary>  Security intelligence update version: **1.357.8.0**<br/> |
| security | Microsoft Threat Experts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-threat-experts.md | Customers can engage our security experts directly from within Microsoft 365 Def - Gain clarity into suspicious device behavior and next steps if faced with an advanced attacker - Determine risk and protection regarding threat actors, campaigns, or emerging attacker techniques -The option to **Consult a threat expert** is available in several places in the portal so you can engage with experts in the context of your investigation: +The option to **Ask Defender Experts** is available in several places in the portal so you can engage with experts in the context of your investigation: - ***Help and support menu***-- :::image type="content" source="images/mte-eod-menu.png" alt-text="The MTE-EOD menu item" lightbox="images/mte-eod-menu.png"::: - - ***Device page actions menu***-- :::image type="content" source="images/mte-eod-machines.png" alt-text="The MTE-EOD device page action menu option" lightbox="images/mte-eod-machines.png"::: - - ***Alerts page actions menu***-- :::image type="content" source="images/mte-eod-alerts.png" alt-text="The MTE-EOD alert page action menu option" lightbox="images/mte-eod-alerts.png"::: - - ***File page actions menu*** - :::image type="content" source="images/mte-eod-file.png" alt-text="The MTE-EOD file page action menu option" lightbox="images/mte-eod-file.png"::: - > [!NOTE] > If you would like to track the status of your Experts on Demand cases through Microsoft Services Hub, reach out to your Customer Success Account Manager. |
| security | Network Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/network-protection.md | ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium Last updated : 08/08/2022 audience: ITPro Last updated - Microsoft Defender Antivirus **Platforms**+ - Windows - macOS - Linux The following example includes the blocked actions: ```kusto DeviceEvents--- Where ActionType in ('ExploitGuardNetworkProtectionAudited','ExploitGuardNetworkProtectionBlocked')+|Where ActionType in ('ExploitGuardNetworkProtectionAudited','ExploitGuardNetworkProtectionBlocked') ``` Here's another example: DeviceEvents: -- where ActionType contains "ExploitGuardNetworkProtection"-- extend ParsedFields=parse_json(AdditionalFields)-- project DeviceName, ActionType, Timestamp, RemoteUrl, InitiatingProcessFileName, IsAudit=tostring(ParsedFields.IsAudit), ResponseCategory=tostring(ParsedFields.ResponseCategory), DisplayName=tostring(ParsedFields.DisplayName)-- sort by Timestamp desc+|where ActionType contains "ExploitGuardNetworkProtection" +|extend ParsedFields=parse_json(AdditionalFields) +|project DeviceName, ActionType, Timestamp, RemoteUrl, InitiatingProcessFileName, IsAudit=tostring(ParsedFields.IsAudit), ResponseCategory=tostring(ParsedFields.ResponseCategory), DisplayName=tostring(ParsedFields.DisplayName) +|sort by Timestamp desc ``` The Response category tells you what caused the event, for example: |
| security | Allow Block Email Spoof | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/allow-block-email-spoof.md | For example, you add an allow entry for the following domain pair: Only messages from that domain _and_ sending infrastructure pair are allowed to spoof. Other senders attempting to spoof gmail.com aren't allowed. Messages from senders in other domains originating from tms.mx.com are checked by spoof intelligence. +> [!NOTE] +> You can't use wildcards in the sending infrastructure. + ## Create blocked spoofed sender entries ### Use Microsoft 365 Defender |
| security | Email Validation And Authentication | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-validation-and-authentication.md | For external domains, the spoofed user is the domain in the From address, while - The source IP address (divided up into /24 CIDR ranges) - The organizational domain of the reverse DNS (PTR) record.+- A verified DKIM domain. ### Create an allow entry for the sender/recipient pair |
| security | Learn About Spoof Intelligence | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/learn-about-spoof-intelligence.md | On the **Spoof intelligence insight** page that appears after you click **View s - **Sending infrastructure**: Also known as the _infrastructure_. The sending infrastructure will be one of the following values: - The domain found in a reverse DNS lookup (PTR record) of the source email server's IP address. - If the source IP address has no PTR record, then the sending infrastructure is identified as \<source IP\>/24 (for example, 192.168.100.100/24).+ - A verified DKIM domain. - **Message count**: The number of messages from the combination of the spoofed domain _and_ the sending infrastructure to your organization within the last 7 days. - **Last seen**: The last date when a message was received from the sending infrastructure that contains the spoofed domain. - **Spoof type**: One of the following values: |
| security | Preset Security Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/preset-security-policies.md | Even if there are no recipient conditions or exceptions applied to a preset secu Set-EOPProtectionPolicyRule -Identity "Standard Preset Security Policy" -ExceptIfSentToMemberOf Executives ``` - This example configures exceptions from the Defender for Office 365 protections in the Strict preset security for the specified security operations (SecOps) mailboxes. + This example configures exceptions from the Defender for Office 365 protections in the Strict preset security policy for the specified security operations (SecOps) mailboxes. ```powershell Set-EOPProtectionPolicyRule -Identity "Strict Preset Security Policy" -ExceptIfSentTo "SecOps1","SecOps2" |
| security | Tenant Allow Block List | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-allow-block-list.md | A domain pair for a spoofed sender in the Tenant Allow/Block List uses the follo - **Sending infrastructure**: This value indicates the source of messages from the spoofed user. Valid values include: - The domain found in a reverse DNS lookup (PTR record) of the source email server's IP address (for example, fabrikam.com). - If the source IP address has no PTR record, then the sending infrastructure is identified as \<source IP\>/24 (for example, 192.168.100.100/24).+ - A verified DKIM domain. Here are some examples of valid domain pairs to identify spoofed senders: |
| security | Use Dkim To Validate Outbound Email | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/use-dkim-to-validate-outbound-email.md | Once you have published the CNAME records in DNS, you are ready to enable DKIM s #### To enable DKIM signing for your custom domain in the Microsoft 365 Defender portal -1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **DKIM** in the **Rules** section. To go directly to the DKIM page, use <https://security.microsoft.com/dkimv2>. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Email Authentication Settings** in the **Rules** section \>**DKIM**. To go directly to the DKIM page, use <https://security.microsoft.com/dkimv2>. 2. On the **DKIM** page, select the domain by clicking on the name. Next, see [**Use DMARC to validate email**](use-dmarc-to-validate-email.md). [An Key rotation via PowerShell: [Rotate-DkimSigningConfig](/powershell/module/exchange/rotate-dkimsigningconfig) -[Use DMARC to validate email](/microsoft-365/security/office-365-security/use-dmarc-to-validate-email?view=o365-worldwide&preserve-view=true) +[Use DMARC to validate email](/microsoft-365/security/office-365-security/use-dmarc-to-validate-email) -[Use trusted ARC Senders for legitimate mailflows](/microsoft-365/security/office-365-security/use-arc-exceptions-to-mark-trusted-arc-senders?view=o365-21vianet&branch=tracyp_emailauth) +[Use trusted ARC Senders for legitimate mailflows](/microsoft-365/security/office-365-security/use-arc-exceptions-to-mark-trusted-arc-senders) |
| security | Walkthrough Spoof Intelligence Insight | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/walkthrough-spoof-intelligence-insight.md | To configure allowed and blocked senders in spoof intelligence, follow these ste ``` 2. Edit the CSV file to add or modify the following values:- - **Sender** (domain in source server's PTR record or IP/24 address) + - **Sender** (domain in source server's PTR record, IP/24 address, or verified DKIM domain) - **SpoofedUser**: One of the following values: - The internal user's email address. - The external user's email domain. |
| solutions | Energy Secure Collaboration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/energy-secure-collaboration.md | Organizations in the energy industry work with and exchange many types of inform In North America, the North America Electric Reliability Corporation (NERC) enforces reliability standards that are referred to as NERC [Critical Infrastructure Protection (CIP) standards](https://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx). NERC is subject to oversight by the U.S. Federal Energy Regulatory Commission (FERC) and governmental authorities in Canada. All bulk power system owners, operators, and users must register with NERC and must comply with NERC CIP standards. Cloud Service Providers and third-party vendors such as Microsoft are not subject to NERC CIP standards. However, the CIP standards include objectives that should be considered when Registered Entities use vendors in the operation of the Bulk Electric System (BES). Microsoft customers operating Bulk Electric Systems are wholly responsible for ensuring their own compliance with NERC CIP standards. For information about Microsoft cloud services and NERC, see the following resources:+ - [NERC CIP Standards and Cloud Computing](https://aka.ms/AzureNERC) - [Cloud Implementation Guide for NERC Audits](https://aka.ms/AzureNERCGuide) -Regulatory standards that are recommended for consideration by energy organizations include FedRAMP (US Federal Risk and Authorization Management Program) which is based on and augments the NIST SP 800-53 Rev 4 standard (National Institute of Standards and Technology). +Regulatory standards that are recommended for consideration by energy organizations include FedRAMP (US Federal Risk and Authorization Management Program) which is based on and augments the NIST SP 800-53 Rev 4 standard (National Institute of Standards and Technology). + - Microsoft Office 365 and Office 365 U.S. Government have each been granted a FedRAMP ATO (Authorization to Operate) at the Moderate Impact Level. - Azure and Azure Government have each been granted a FedRAMP High P-ATO (Provisional Authorization to Operate), which represents the highest level of FedRAMP authorization. For information about Microsoft cloud services and FedRAMP, see the following resources:+ - [Microsoft FedRAMP overview](/compliance/regulatory/offering-FedRAMP) - [Office 365 FedRAMP reports](https://servicetrust.microsoft.com/ViewPage/MSComplianceGuideV3?docTab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb_FedRAMP_Reports) - These achievements are significant for the energy industry because a comparison between the FedRAMP Moderate control set and NERC CIP requirements shows that FedRAMP Moderate controls encompass all the NERC CIP requirements. For additional information, Microsoft developed a [Cloud Implementation Guide for NERC Audits](https://servicetrust.microsoft.com/ViewPage/TrustDocuments?command=Download&downloadType=Document&downloadId=68df41b2-873d-4e4b-a7c8-8a0d4fdefb88&docTab=6d000410-c9e9-11e7-9a91-892aae8839ad_Compliance_Guides) that includes a control mapping between the current set of NERC CIP standards and FedRAMP Moderate control set as documented in NIST 800-53 Rev 4. As the energy industry looks to modernize their collaboration platforms, careful consideration is required for the configuration and deployment of collaboration tools and security controls, including:+ - Assessment of common collaboration scenarios - Access to data required by employees to be productive - Regulatory compliance requirements - Associated risks to data, customers and the organization Microsoft 365 is a modern workplace cloud environment. It provides secure and flexible collaboration across the enterprise, including controls and policy enforcement to adhere to the most stringent regulatory compliance frameworks. Through the following topics, this paper explores how Microsoft 365 helps the energy industry move to a modern collaboration platform while helping to keep data and systems both secure and compliant with regulations:+ - Provide a Comprehensive Collaboration Platform with Microsoft Teams - Provide Secure and Compliant Collaboration in the Energy Industry - Identify Sensitive Data and Prevent Data Loss Microsoft 365 is a modern workplace cloud environment. It provides secure and fl As a Microsoft partner, Protiviti contributed to and provided material feedback to this article. ## Provide a Comprehensive Collaboration Platform with Microsoft Teams+ Collaboration typically requires multiple forms of communication, the ability to store and access documents, and the ability to integrate other applications as needed. Whether they are global enterprises or local companies, employees in the energy sector typically need to collaborate and communicate with members of other departments or across teams. They also often need to communicate with external partners, vendors, or clients. As a result, using systems that create silos or make it difficult to share information is typically not recommended. That said, we still want to ensure that employees are sharing information securely and according to policy. Providing employees with a modern and cloud-based collaboration platform, that allows them to choose and easily integrate the tools that make them most productive, empowers them to find the best ways to work and collaborate. Using Microsoft Teams, together with security controls and governance policies to protect the organization, can help your workforce to easily collaborate in the cloud. Microsoft Teams provides a collaboration hub for your organization to bring peop Every Microsoft Team is backed by an Office 365 Group. An Office 365 Group is considered the membership provider for Office 365 services, including Microsoft Teams. Office 365 Groups are used to securely control which users are considered members and which are owners of the group. This allows us to easily control which users have access to varying capabilities within Teams. As a result, Team members and owners may only access the capabilities that they are permitted to utilize. A common scenario where Microsoft Teams can benefit energy organizations is collaborating with contractors or external firms as part of a field service program, such as vegetation management. Contractors are typically engaged to manage vegetation or remove trees around power system installations. They often need to receive work instructions, communicate with dispatchers and other field service personnel, take and share pictures of external surroundings, sign off when work is complete, and share data back with head office. Traditionally, these programs have been run using phone, text, paper work orders, or custom applications. This can present many challenges including:+ - Processes are manual or analog, making metrics difficult to track - Communications are not all captured in one place - Data is siloed and not necessarily shared with all employees that need it Microsoft 365 provides common policy capabilities for Microsoft Teams through it **Office 365 Group Naming Policies** help ensure that Office 365 Groups, and therefore Microsoft Teams, are named according to corporate policy. The name of a Team can present challenges if not named appropriately. For example, employees might not know which teams to work or share information within if they are incorrectly named. Group naming policies help enforce good hygiene and may also prevent use of specific words, such as reserved words or inappropriate terminology. **Office 365 Group Expiration Policies** help to ensure that Office 365 Groups, and therefore Microsoft Teams, are not retained for longer periods of time than required by the organization. This capability helps to prevent two key information management issues:+ - The proliferation of Microsoft Teams that are not necessary or used - The over-retention of data that is no longer required by the organization The over-retention of data in a Microsoft Team can pose litigation risks to orga Microsoft Teams enables self-service creation of Teams by default. However, many regulated organizations want to control and understand which collaboration spaces are currently in use by employees, which spaces contain sensitive data, and who the owners are of spaces throughout their organization. To facilitate these controls, Microsoft 365 allows organizations to disable self-service Teams creation. Also, using built-in Microsoft 365 business process automation tools, such as Power Apps and Power Automate, allows organizations to build simple processes to request a new Team. Completing an easy to use form, an approval can be automatically requested by a manager. Once approved, the Team can be automatically provisioned and the requestor is sent a link to their new Team. By building such processes, organizations can also integrate custom requirements to facilitate other business processes. ## Provide Secure and Compliant Collaboration in the Energy Industry+ As mentioned, Microsoft Office 365 and Office 365 U.S. Government have each achieved FedRAMP ATO at the Moderate Impact Level. Azure and Azure Government have achieved a FedRAMP High P-ATO which represents the highest level of FedRAMP authorization. Additionally, the FedRAMP moderate control set encompasses all of the NERC CIP requirements, thereby allowing energy industry organizations ("registered entities") to leverage existing FedRAMP authorizations as a scalable and efficient approach to addressing NERC audit requirements. However, it's important to note that FedRAMP is not a point-in-time certification but an assessment and authorization program that includes provisions for [continuous monitoring](https://www.fedramp.gov/assets/resources/documents/CSP_Continuous_Monitoring_Strategy_Guide.pdf). Although this provision applies primarily to the CSP, Microsoft customers operating Bulk Electric Systems are responsible for ensuring their own compliance with NERC CIP standards. It is generally a recommended practice to continuously monitor the organization's compliance posture to help ensure ongoing compliance with regulations. Microsoft provides a key tool to assist with monitoring compliance with regulations over time: Microsoft provides a key tool to assist with monitoring compliance with regulati - **Microsoft Purview Compliance Manager** helps the organization understand its current compliance posture and the actions it can take to help improve that posture. Compliance Manager calculates a risk-based score measuring progress in completing actions that help reduce risks around data protection and regulatory standards. Compliance Manager provides an initial score based on the Microsoft 365 data protection baseline. This baseline is a set of controls that include common industry regulations and standards. While this score is a good starting point, Compliance Manager becomes more powerful once an organization adds assessments that are more relevant to their industry. Compliance Manager supports a number of regulatory standards that are relevant for NERC CIP compliance obligations, including the [FedRAMP Moderate Control Set](https://www.fedramp.gov/documents/), [NIST 800-53 Rev. 4](https://go.microsoft.com/fwlink/?linkid=2109075), and [AICPA SOC 2](https://go.microsoft.com/fwlink/?linkid=2115184). Energy industry organizations may also create or import custom control sets if needed. The workflow capabilities built into Compliance Manager allow energy organizations to transform and digitize their regulatory compliance processes. Traditionally, compliance teams in the energy industry face the following challenges:+ - Inconsistent reporting or tracking of progress on remediation actions - Inefficient or ineffective processes - Insufficient resources or lack of ownership Compliance Manager does not express an absolute measure of organizational compli Many cyber security-related controls are included in the [FedRAMP Moderate Control Set](https://www.fedramp.gov/documents/) and [NERC CIP standards](https://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx). However, key controls related to the Microsoft 365 platform include security management controls (CIP-003-6), account and access management/access revocation (CIP-004-6), electronic security perimeter (CIP-005-5), security event monitoring, and incident response (CIP-008-5). The following foundational Microsoft 365 capabilities help to address the risks and requirements included in these topics. ### Secure User Identities and Control Access+ Protecting access to documents and applications begins with strongly securing user identities. As a foundation, this requires providing a secure platform for the enterprise to store and manage identities and providing a trusted means of authentication. It also requires dynamically controlling access to these applications. As employees work, they may move from application to application or across multiple locations and devices. As a result, access to data must be authenticated at each step of the way. In addition, the authentication process must support a strong protocol and multiple factors of authentication (one-time SMS pass code, authenticator app, certificate, etc.) to ensure that identities have not been compromised. Finally, enforcing risk-based access policies are a key recommendation to protecting data and applications from insider threats, inadvertent data leaks, and data exfiltration. Microsoft 365 provides a secure identify platform with **Azure Active Directory (Azure AD)** where identities are centrally stored and securely managed. Azure Active Directory, along with a host of related Microsoft 365 security services, forms the basis for providing employees with the access they need to work securely while also protecting the organization from threats. Microsoft 365 provides a secure identify platform with **Azure Active Directory **Azure Active Directory**, and the related Microsoft 365 security services, provide the foundation upon which a modern cloud collaboration platform can be rolled out to energy industry organizations. Azure Active Directory includes controls to protect access to data and applications. In addition to providing strong security, these controls help organizations meet regulatory compliance obligations. Azure Active Directory and Microsoft 365 services and are deeply integrated and provides the following important capabilities:+ - Centrally store and securely manage user identities - Use a strong authentication protocol, including multi-factor authentication, to authenticate users on access requests - Provide a consistent and robust authentication experience across any application Azure Active Directory and Microsoft 365 services and are deeply integrated and - Monitor and control access to Microsoft and non-Microsoft cloud applications - Proactively protect against email phishing and ransomware attacks -## Identify Sensitive Data and Prevent Data Loss +## Identify Sensitive Data and Prevent Data Loss + The FedRAMP Moderate Control Set and NERC CIP standards also include information protection as a key control requirement (CIP-011-2). These requirements specifically address the need to identify information related to BES (Bulk Electric System) Cyber System Information and the protection and secure handling of that information (including storage, transit, and use). Specific examples of BES Cyber System Information can include security procedures or security information about systems that are fundamental to operating the bulk electric system (BES Cyber Systems, Physical Access Control Systems, and Electronic Access Control or monitoring systems) that is not publicly available and could be used to allow unauthorized access or unauthorized distribution. However, the same need exists to identify and protect customer information that is critical to the day-to-day operations of energy organizations. Microsoft 365 allows sensitive data to be identified and protected within the organization through a combination of powerful capabilities, including: Applying sensitivity labels to documents and emails embeds metadata within the o Rolling out Microsoft Purview Information Protection and DLP policies to organizations requires careful planning. It also requires user education so employees understand the organization's data classification schema and which types of data are sensitive. Providing employees with tools and education programs that help them identify sensitive data and help them understand how to handle it makes them part of the solution for mitigating information security risks. ## Govern Data by Effectively Managing Records+ Regulations require many organizations to manage the retention of key organizational documents according to a managed corporate retention schedule. Organizations face regulatory compliance risks if data is under-retained (deleted too early), or legal risks if data is over-retained (kept too long). Effective records management strategies help ensure that organization documents are retained according to predetermined retention periods which are designed to minimize risk to the organization. Retention periods are prescribed in a centrally managed organizational record retention schedule. Retention periods are based on the nature of each type of document, the regulatory compliance requirements for retaining specific types of data, and the defined policies of the organization. Assigning record retention periods accurately across organizational documents may require a granular process which assigns retention periods uniquely to individual documents. Applying record retention policies at scale can be challenging for many reasons. These reasons include the vast number of documents within energy industry organizations together with the fact that, in many cases, retention periods can be triggered by organizational events (such as contracts expiring or an employee leaving the organization). Microsoft 365 provides capabilities for defining retention labels and policies to easily implement records management requirements. A record manager defines a retention label, which represents a "record type" in a traditional retention schedule. The retention label contains settings which define:+ - How long a record is retained for - The concurrency requirements or what occurs when retention period expires (delete the document, start a disposition review, or take no action) - What triggers the retention period to start (created date, last modified date, labeled date, or an event), and The FedRAMP Moderate Control Set and NERC CIP standards also include Asset Reuse With each retention label, Microsoft 365 allows record managers to determine if a disposition review is required. Then when those record types come up for disposition, after their retention period has expired, a review must be conducted by the designated disposition reviewers before content is deleted. Once the disposition review is approved, content deletion will proceed. However, evidence of the deletion (the user that performed the deletion and date/time in which it occurred) is still retained for multiple years as a certificate of destruction. If organizations require longer or permanent retention of certificates of destruction, Microsoft Sentinel may be used for long-term cloud-based storage of log and audit data. Microsoft Sentinel gives organizations full control over the long-term storage and retention of activity data, log data, and retention/disposition data. ## Comply with FERC and FTC Regulations for Energy Markets+ The U.S. Federal Energy Regulatory Commission (FERC) oversees [regulations related to energy markets and trading for the electric energy and natural gas markets](https://www.ferc.gov). The U.S. Federal Trade Commission (FTC) oversees similar [regulations in the petroleum market](https://www.ftc.gov/sites/default/files/documents/rules/prohibition-energy-market-manipulation-rule/091113mmrguide.pdf). In both cases these regulatory bodies set out rules and guidance to prohibit the manipulation of energy markets. FERC, for example, recommends that energy organizations invest in technology resources to monitor trading, trader communications, and compliance with internal controls. Regulators also recommend that energy organizations evaluate, on a regular basis, the ongoing effectiveness of the organization's compliance program. Traditionally, communication monitoring solutions are costly and they can be complex to configure and manage. Also, organizations can experience challenges with monitoring the many, varying communication channels available to employees. Microsoft 365 provides several built-in robust capabilities for monitoring employee communications, supervising employee activities, and helping to comply with FERC regulations for energy markets. ### Implement Supervisory Control+ Microsoft 365 enables organizations to configure supervision policies which capture employee communications (based on configured conditions) and allow these to be reviewed by designated supervisors. Supervision policies can capture internal/external email and attachments, Microsoft Teams chat and channel communications, Skype for Business Online chat communications and attachments, and communications through third-party services (such as Facebook or Dropbox). The comprehensive nature of communications that may be captured and reviewed within an organization and the extensive conditions with which policies may be configured allow Microsoft 365 Supervision Policies to help organizations comply with FERC energy market regulations. Supervision policies can be configured to review communications for individuals or groups. In addition, supervisors may be configured to be individuals or groups. Comprehensive conditions may be configured to capture communications based on inbound or outbound messages, domains, retention labels, keywords or phrases, keyword dictionaries, sensitive data types, attachments, message size, or attachment size. Reviewers are provided with a dashboard where they can review flagged communications, act on communications that potentially violate policies, or mark flagged items as resolved. They may also review the results of previous reviews and items that have been resolved. Microsoft 365 provides reports which allow supervision policy review activities Microsoft 365 Supervision Policies allow organizations to monitor communications for compliance with corporate policies, such as human resources harassment violations and offensive language in company communications. It also allows organizations to reduce risk, by monitoring communications when organizations are undergoing sensitive organizational changes, such as mergers and acquisitions, or leadership changes. -### Communication Compliance -With many communication channels available to employees, organizations increasingly require effective solutions for monitoring or supervising communications in regulated industries such as energy trading markets. The recently launched Communication Compliance solution built into Microsoft 365 helps organizations overcome common challenges. These challenges can include increasing numbers of communication channels and message volume and the risk of potential fines for policy violations. +### Communication compliance -Communication Compliance can monitor multiple communication channels and use machine learning models to identify potential policy violations, including Office 365 email, Microsoft Teams, Skype for Business Online, Facebook, Twitter and Bloomberg instant messages. Communication Compliance helps compliance teams effectively and efficiently review messages for potential violations of: -- Corporate Policies, such as acceptable use, ethical standards, and corporate specific policies +With many communication channels available to employees, organizations increasingly require effective solutions for detecting and investigating communications in regulated industries such as energy trading markets. These challenges can include increasing numbers of communication channels and message volume and the risk of potential fines for policy violations. ++[Microsoft Purview Communication Compliance](/microsoft-365/compliance/communication-compliance) is a compliance solution that helps minimize communication risks by helping you detect, investigate, and act on inappropriate messages in your organization. Pre-defined and custom policies allow you to scan internal and external communications for policy matches so they can be examined by designated reviewers. Reviewers can investigate scanned email, Microsoft Teams, Yammer, or third-party communications in your organization and take appropriate actions to make sure they're compliant with your organization's message standards. ++Communication Compliance helps compliance teams effectively and efficiently review messages for potential violations of: ++- corporate Policies, such as acceptable use, ethical standards, and corporate specific policies - sensitivity or sensitive business disclosures, such as unauthorized communications about sensitive projects like upcoming acquisitions, mergers, earnings disclosures, reorganizations, or leadership team changes-- Regulatory compliance requirements, such as employee communications regarding the types of businesses or transactions in which an organization engages in compliance with FERC regulations for energy markets+- regulatory compliance requirements, such as employee communications regarding the types of businesses or transactions in which an organization engages in compliance with FERC regulations for energy markets -Communication Compliance provides built-in threat, harassment, and profanity classifiers to help reduce false positives when reviewing communications. This saves reviewers time during the investigation and remediation process. It helps reviewers focus on specific messages within long threads that have been highlighted by policy alerts. This helps compliance teams more quickly identify and remediate risks. It provides compliance teams with the ability to easily configure and fine-tune policies, adjusting the solution to the organization's specific needs and reducing false positives. Communication Compliance can also track user behavior over time, highlighting potential patterns in risky behavior or policy violations. Finally, it provides flexible built-in remediation workflows. These workflows help reviewers quickly take action to escalate to legal or human resources teams according to defined corporate processes. +Communication compliance provides built-in threat, harassment, and profanity classifiers to help reduce false positives when reviewing communications. This saves reviewers time during the investigation and remediation process. It helps reviewers focus on specific messages within long threads that have been highlighted by policy alerts. This helps compliance teams more quickly identify and remediate risks. It provides compliance teams with the ability to easily configure and fine-tune policies, adjusting the solution to the organization's specific needs and reducing false positives. Communication compliance can also help to identify potentially risky user behavior over time, highlighting potential patterns in risky behavior or policy violations. Finally, it provides flexible built-in remediation workflows. These workflows help reviewers quickly take action to escalate to legal or human resources teams according to defined corporate processes. -## Protect Against Data Exfiltration and Insider Risk -A common threat to enterprises is data exfiltration, or the act of extracting data from an organization. This can be a significant concern for energy organizations due to the sensitive nature of the information that may be accessed by employees or field service staff day-to-day. This data includes both BES (Bulk Electric System) Cyber System information as well as business-related information and customer data. With the increasing methods of communications available and many tools for moving data, advanced tools are typically required to mitigate risks of data leaks, policy violations, and insider risk. +## Protect against data exfiltration and insider risk ++A common threat to enterprises is data exfiltration, or the act of extracting data from an organization. This can be a significant concern for energy organizations due to the sensitive nature of the information that may be accessed by employees or field service staff day-to-day. This data includes both BES (Bulk Electric System) Cyber System information as well as business-related information and customer data. With the increasing methods of communications available and many tools for moving data, advanced tools are typically required to mitigate risks of data leaks, policy violations, and insider risk. ++### Insider risk management -### Insider Risk Management Enabling employees with online collaboration tools that may be accessed anywhere inherently brings risk to an organization. Employees may inadvertently or maliciously leak data to attackers or to competitors. Alternatively, they may exfiltrate data for personal use or take data with them to a future employer. These scenarios present serious risks to organizations from a security and a compliance standpoint. Identifying these risks when they occur and quickly mitigating them requires both intelligent tools for data collection and collaboration across departments such as legal, human resources, and information security. -Microsoft 365 has recently launched the Insider Risk Management console which uses signals across Microsoft 365 services and machine learning models to monitor user behavior for signs of insider risk. This tool presents data to investigators so that they can easily identify risky behavior patterns and escalate cases based on pre-determined workflows. +[Microsoft Purview Insider Risk Management](/microsoft-365/compliance/insider-risk-management) is a compliance solution that helps minimize internal risks by enabling you to detect, investigate, and act on malicious and inadvertent activities in your organization. Insider risk policies allow you to define the types of risks to identify and detect in your organization, including acting on cases and escalating cases to Microsoft eDiscovery (Premium) if needed. Risk analysts in your organization can quickly take appropriate actions to make sure users are compliant with your organization's compliance standards. -For example, Insider Risk Management can correlate signals from a user's Windows 10 desktop (such as copying files to a USB drive or emailing a personal email account) with activities from online services (such as Office 365 email, SharePoint Online, Microsoft Teams, OneDrive for Business) to identify data exfiltration patterns. It can also correlate these activities with employees leaving an organization which is a common behavioral pattern associated with data exfiltration. It can monitor multiple activities and behavior over time. When common patterns emerge, it can raise alerts and help investigators focus on key activities to verify a policy violation with a high degree of confidence. Insider Risk Management can also obfuscate data from investigators to help meet data privacy regulations while still surfacing key activities that help them efficiently perform investigations. When ready, it allows investigators to package and securely send key activity data to human resources and legal departments following common escalation workflows for raising cases for remediation action. +For example, insider risk management can correlate signals from a user's devices (such as copying files to a USB drive or emailing a personal email account) with activities from online services (such as Office 365 email, SharePoint Online, Microsoft Teams, OneDrive for Business) to identify data exfiltration patterns. It can also correlate these activities with employees leaving an organization which is a common behavioral pattern associated with data exfiltration. It can detect multiple potentially risky activities and behavior over time. When common patterns emerge, it can raise alerts and help investigators focus on key activities to verify a policy violation with a high degree of confidence. Insider risk management can also obfuscate data from investigators to help meet data privacy regulations while still surfacing key activities that help them efficiently perform investigations. When ready, it allows investigators to package and securely send key activity data to human resources and legal departments following common escalation workflows for raising cases for remediation action. -Insider Risk Management is a significant increase in capabilities in Microsoft 365 for monitoring and investigating insider risks while allowing organizations to still meet data privacy regulations and follow established escalations paths when cases require higher-level action. +Insider risk management is a significant increase in capabilities in Microsoft 365 for detecting and investigating insider risks while allowing organizations to still meet data privacy regulations and follow established escalations paths when cases require higher-level action. ## Conclusion+ Microsoft 365 provides an integrated and comprehensive solution which enables easy-to-use cloud-based collaboration across the enterprise with Microsoft Teams. Microsoft Teams also enables better communication and collaboration with field service staff, helping energy organizations to be more efficient and effective. Better collaboration across the enterprise and with field staff can ultimately help energy organizations to better serve customers. Energy industry organizations must comply with strict regulations related to how they store, secure, manage, and retain information related to their operations and customers. They must also comply with regulations related to how they monitor and prevent the manipulation of energy markets. Microsoft 365 provides robust security controls for protecting data, identities, devices, and applications from risks and complying with strict energy industry regulations. Built-in tools are provided to help energy organizations assess their compliance, as well as take action and track remediation activities over time. These tools also provide easy to use methods for monitoring and supervising communications. The Microsoft 365 platform is built on foundational components like Microsoft Azure and Azure Active Directory, helping to secure the overall platform and helping the organization meet compliance requirements for FedRAMP Moderate and High control sets. This in turn contributes to an energy organization's ability to meet NERC CIP standards. |
| solutions | Financial Services Secure Collaboration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/financial-services-secure-collaboration.md | f1.keywords: NOCSH # Key compliance and security considerations for US banking and capital markets ## Introduction+ Financial services institutions surpass nearly all commercial businesses in their demand for stringent security, compliance, and governance controls. The protection of data, identities, devices, and applications is not only critical to their business, it's subject to compliance requirements and guidelines from regulatory bodies such as the U.S. Securities and Exchange Commission (SEC), the Financial Industry Regulatory Authority (FINRA), the Federal Financial Institutions Examination Council (FFIEC), and the Commodity Futures Trading Commission (CFTC). In addition, financial institutions are subject to laws such as Dodd-Frank and the Sarbanes-Oxley Act of 2002. In today's climate of increased security vigilance, insider risk concerns and public data breaches, customers also demand high levels of security from their financial institutions in order to trust them with their personal data and banking assets. In today's climate of increased security vigilance, insider risk concerns and pu Historically, the need for comprehensive controls directly impacted and constrained the IT systems and platforms that financial institutions use to enable collaboration internally and externally. Today, financial services employees need a modern collaboration platform that's easy to adopt and easy to use. But financial services can't trade the flexibility to collaborate between users, teams, and departments with security and compliance controls that enforce policies to protect users and IT systems from threats. In the financial services sector, careful consideration is required for the configuration and deployment of collaboration tools and security controls, including:+ - Risk assessment of common organizational collaboration and business process scenarios - Information protection and data governance requirements - Cybersecurity and insider threats Teams provides a collaboration hub for the organization. It helps bring people t Every Microsoft Team is backed by a Microsoft 365 group. That group is considered the membership service for numerous Office 365 services, including Teams. Microsoft 365 groups are used to securely distinguish between "owners" and "members" and to control access to various capabilities within Teams. When coupled with appropriate governance controls and regularly administered access reviews, Teams allows only members and owners to utilize authorized channels and capabilities. A common scenario where Teams benefits financial services is when running internal projects or programs. For example, many financial institutions, including banks, wealth management firms, credit unions, and insurance providers, are required to have anti-money laundering and other compliance programs in place. A cross-functional team comprised of IT, lines of business such as retail and wealth management, and a financial crime unit may be required to share data with each other and communicate about the program or specific investigations. Traditionally, these programs have used shared network drives, but this approach can present numerous challenges, including:+ * Only one person can edit a document at a time. * Managing security is time-consuming because adding/removing individuals typically involves IT. * Data remains resident on shared network drives much longer than required or wanted. FINRA [emphasizes that the digital communications of regulated firms meet the re If an organization permits its employees to use a specific application, such as an app-based messaging service or collaboration platform, the firm must archive business records and supervise the activities and communications of those employees in that application. Organizations are responsible for conducting due diligence to comply with FINRA rules and securities laws, and for following up on potential violations of those rules related to employee use of such apps. Effective practices recommended by FINRA include the following:+ * Establish a comprehensive governance program for digital communication channels. Manage the organization's decisions about which digital communication channels are permitted and define compliance processes for each digital channel. Closely monitor the rapidly changing landscape of digital communication channels and keep compliance processes up to date. * Clearly define and control permissible digital channels. Define both approved and prohibited digital channels. Block or restrict the use of prohibited digital channels, or prohibited features within digital channels, that limit the organization's ability to comply with records management and supervisory requirements. * Provide training for digital communications. Implement mandatory training programs before giving registered representatives access to approved digital channels. Training helps clarify an organization's expectations for business and personal digital communications, and it guides staff through using permitted features of each channel in a compliant manner. Azure AD, and the related Microsoft 365 security services, provide the foundatio * Proactively protect against email phishing and ransomware attacks. #### Azure AD Identity Protection+ While Conditional Access protects resources from suspicious requests, Identity Protection goes further by providing ongoing risk detection and remediation of suspicious user accounts. Identity Protection keeps you informed of suspicious user and sign-in behavior in your environment around the clock. Its automatic response proactively prevents compromised identities from being abused. Identity Protection is a tool that allows organizations to accomplish three key tasks: Identity Protection helps organizations automatically protect against identity c  ## Identify sensitive data and prevent data loss+ Microsoft 365 allows all organizations to identify sensitive data within the organization through a combination of powerful capabilities, including: * **Microsoft Purview Information Protection** for both user-based classification and automated classification of sensitive data. Information barriers support conversations and files in Teams. They can prevent Financial institutions are typically required to establish and maintain a supervisory function within their organizations to monitor the activities of employees and to help it achieve compliance with applicable securities laws. Specifically, FINRA has established these supervision requirements: * [FINRA Rule 3110 (Supervision)](https://www.finra.org/rules-guidance/rulebooks/finra-rules/3110) requires firms to have written supervisory procedures (WSPs) to supervise activities of its employees and the types of businesses in which it engages. In addition to other requirements, procedures must include:+ - Supervision of supervisory personnel - Review of a firm's investment banking, securities business, internal communications, and internal investigations - Review of transactions for insider trading Financial institutions are typically required to establish and maintain a superv ### Communication compliance -Communication compliance enables organizations to pre-configure policies to capture employee communications for monitoring and review by authorized supervisors. Policies in communication compliance can capture internal/external email and attachments, Teams chat and channel communications, and Skype for Business Online chat communications and attachments. In addition, communication compliance can ingest communications and data from third-party services (such as Bloomberg, Thomson Reuters, LinkedIn, Twitter, Facebook, Box, and Dropbox). -The comprehensive nature of communications that can be captured and reviewed within an organization, and the extensive conditions with which policies may be configured, allow communication compliance policies to help financial institutions comply with FINRA Rule 3110. Policies may be configured to review communications for individuals or groups. Designated supervisors can be assigned at an individual or group level. Comprehensive conditions can be configured to capture communications based on inbound or outbound messages, domains, retention labels, keywords or phrases, keyword dictionaries, sensitive data types, attachments, message size, or attachment size. Reviewers get a dashboard in which they can review flagged communications, act on communications that potentially violate policies, and mark flagged items as resolved. They can also review the results of reviews and items that were previously resolved. +[Microsoft Purview Communication Compliance](/microsoft-365/compliance/communication-compliance) is a compliance solution that helps minimize communication risks by helping you detect, investigate, and act on inappropriate messages in your organization. Pre-defined and custom policies allow you to scan internal and external communications for policy matches so they can be examined by designated reviewers. Reviewers can investigate scanned email, Microsoft Teams, Yammer, or third-party communications in your organization and take appropriate actions to make sure they're compliant with your organization's message standards. -Communication compliance provides reports that enable policy review activities to be audited based on the policy and the reviewer. Reports are available to validate that policies are working as defined by an organization's written supervision policies. They can also be used to identify communications that require review and those that are not compliant with corporate policy. Finally, all activities related to configuring policies and reviewing communications are audited in the Office 365 unified audit log. As a result, communication compliance also helps financial institutions to comply with FINRA Rule 3120. +Communication compliance provides reports that enable policy review activities to be audited based on the policy and the reviewer. Reports are available to validate that policies are working as defined by an organization's written policies. They can also be used to identify communications that require review and those that are not compliant with corporate policy. Finally, all activities related to configuring policies and reviewing communications are audited in the Office 365 unified audit log. As a result, communication compliance also helps financial institutions to comply with FINRA Rule 3120. -In addition to complying with FINRA rules, communication compliance allows organizations to monitor communications for compliance with other legal requirements, corporate policies, and ethical standards. Communication compliance provides built-in threat, harassment, and profanity classifiers that help reduce false positives when reviewing communications, saving reviewers time during the investigation and remediation process. It also allows organizations to reduce risk by monitoring communications when they undergo sensitive changes, such as mergers and acquisitions or leadership changes. +In addition to complying with FINRA rules, communication compliance allows organizations to detect and act on communications that may be impacted by other legal requirements, corporate policies, and ethical standards. Communication compliance provides built-in threat, harassment, and profanity classifiers that help reduce false positives when reviewing communications, saving reviewers time during the investigation and remediation process. It also allows organizations to reduce risk by detecting communications when they undergo sensitive organizational changes, such as mergers and acquisitions or leadership changes.  A common threat to enterprises is data exfiltration, or the act of extracting da Enabling employees with online collaboration tools that can be accessed anywhere inherently brings risk to the organization. Employees may inadvertently or maliciously leak data to attackers or competitors. Alternatively, they may exfiltrate data for personal use or take data with them to a future employer. These scenarios present serious risks to financial services institutions from both security and compliance standpoints. Identifying these risks when they occur and quickly mitigating them requires both intelligent tools for data collection and collaboration across departments such as legal, human resources, and information security. -Microsoft 365 recently launched an insider risk management solution that correlates signals across Microsoft 365 services and uses machine learning models to analyze user behavior for hidden patterns and signs of insider risk. This tool enables collaboration between security operations, internal investigators, and HR so that they can easily remediate cases based on predetermined workflows. +[Microsoft Purview Insider Risk Management](/microsoft-365/compliance/insider-risk-management) is a compliance solution that helps minimize internal risks by enabling you to detect, investigate, and act on malicious and inadvertent activities in your organization. Insider risk policies allow you to define the types of risks to identify and detect in your organization, including acting on cases and escalating cases to Microsoft eDiscovery (Premium) if needed. Risk analysts in your organization can quickly take appropriate actions to make sure users are compliant with your organization's compliance standards. -For example, insider risk management can correlate signals from a user's Windows 10 desktop, such as copying files to a USB drive or emailing a personal email account, with activities from online services such as Office 365 email, SharePoint Online, Microsoft Teams, or OneDrive for Business, to identify data exfiltration patterns. It can also correlate these activities with employees leaving an organization, which is a common data exfiltration pattern. It can monitor multiple activities and behavior over time. When common patterns emerge, it can raise alerts and help investigators focus on key activities to verify a policy violation with a high degree of confidence. Insider risk management can pseudo-anonymize data from investigators to help meet data privacy regulations, while still surfacing key activities that help them perform investigations efficiently. It allows investigators to package and securely send key activity data to the HR and legal departments, following common escalation workflows for raising cases for remediation action. +For example, insider risk management can correlate signals from a user's devices, such as copying files to a USB drive or emailing a personal email account, with activities from online services such as Office 365 email, SharePoint Online, Microsoft Teams, or OneDrive for Business, to identify data exfiltration patterns. It can also correlate these activities with employees leaving an organization, which is a common data exfiltration pattern. It can detect multiple potentially risky activities and behavior over time. When common patterns emerge, it can raise alerts and help investigators focus on key activities to verify a policy violation with a high degree of confidence. Insider risk management can pseudo-anonymize data from investigators to help meet data privacy regulations, while still surfacing key activities that help them perform investigations efficiently. It allows investigators to package and securely send key activity data to the HR and legal departments, following common escalation workflows for raising cases for remediation action. -Insider risk management significantly increases capabilities of organizations to monitor and investigate insider risks while allowing organizations to still meet data privacy regulations and follow established escalation paths when cases require higher-level action. For more information about insider risk management, see [Modern risk pain points and Workflow in Insider risk management](../compliance/insider-risk-management.md). +Insider risk management significantly increases capabilities of organizations to detect and investigate insider risks while allowing organizations to still meet data privacy regulations and follow established escalation paths when cases require higher-level action.  |