| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Activity Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/activity-reports/activity-reports.md | Title: "Microsoft 365 admin center activity reports" f1.keywords: - NOCSH--++ audience: Admin You can easily see how people in your business are using Microsoft 365 services. Reports are available for the last 7 days, 30 days, 90 days, and 180 days. Data won't exist for all reporting periods right away. The reports become available within 48 hours. -## Watch: Act on a usage report in Office 365 +## Watch: Act on a usage report in Microsoft 365 -Check out this video and others on our [YouTube channel](https://go.microsoft.com/fwlink/?linkid=2198103). +Check out this video and others on our [YouTube channel](https://go.microsoft.com/fwlink/?linkid=2198103).<br><br> > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4VjrX?autoplay=false] Your user list will look like this: If you want to unhide user-level information when you're generating your reports, a **global administrator** can quickly make that change in the admin center. -Reports provide information about your organizationΓÇÖs usage data. By default, reports display information with identifiable names for users, groups, and sites. Starting September 1, 2021, we are hiding user information by default for all reports as part of our ongoing commitment to help companies support their local privacy laws. +Reports provide information about your organization's usage data. By default, reports display information with identifiable names for users, groups, and sites. Starting September 1, 2021, we are hiding user information by default for all reports as part of our ongoing commitment to help companies support their local privacy laws. Global administrators can revert this change for their tenant and show identifiable user information if their organization's privacy practices allow it. It can be achieved in the Microsoft 365 admin center by following these steps: |
| admin | Setup Business Basic | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/setup/setup-business-basic.md | description: "Learn how to set up your Microsoft 365 Business Basic subscription If you found this video helpful, check out the [complete training series for small businesses and those new to Microsoft 365](../../business-video/index.yml). -## Add your domain to personalize sign-in +## Add an existing domain to your Microsoft 365 Business Basic subscription When you purchase Microsoft 365 Business Basic, you have the option of using a domain you own, or buying one during the sign-up. When you purchase Microsoft 365 Business Basic, you have the option of using a d ::: moniker range="o365-worldwide" -1. Go to the admin center at <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">https://admin.microsoft.com</a>. +1. Go to the Microsoft 365 admin center at <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">https://admin.microsoft.com</a>. ::: moniker-end When you purchase Microsoft 365 Business Basic, you have the option of using a d 1. Go to the admin center at <a href="https://go.microsoft.com/fwlink/p/?linkid=850627" target="_blank">https://portal.partner.microsoftonline.cn</a>. 2. Choose **Go to setup** to start the wizard.- + 3. In the **Add domain** step, enter the domain name you want to use (like contoso.com). > [!IMPORTANT] > If you purchased a domain during the sign-up, you will not see **Add a domain** step here. Go to [Add users](#add-users-and-assign-licenses) instead. - 4. Follow the steps in the wizard to [Create DNS records at any DNS hosting provider for Office 365](/office365/admin/get-help-with-domains/create-dns-records-at-any-dns-hosting-provider) that verifies you own the domain. If you know your domain host, see also [Add a domain to Microsoft 365](/microsoft-365/admin/setup/add-domain). If your hosting provider is GoDaddy or another host enabled with [domain connect](/office365/admin/get-help-with-domains/domain-connect), the process is easy and you'll be automatically asked to sign in and let Microsoft authenticate on your behalf. When you purchase Microsoft 365 Business Basic, you have the option of using a d ## Add users and assign licenses -You can add users in the wizard, but you can also [add users later](../add-users/add-users.md) in the admin center. Additionally, if you have a local domain controller, you can add users with [Azure AD Connect](/azure/active-directory/hybrid/how-to-connect-install-express). --## Add users in the wizard +You can add users in the wizard, but you can also [add users later](../add-users/add-users.md) in the admin center. Any users you add in the wizard get automatically assigned a Microsoft 365 Business Basic license. To set up services, you have to update some records at your DNS host or domain r When the signup process is complete, you'll be directed to the admin center, where you can add users, and assign licenses. After you complete the initial setup, you can use the **Setup** page in the admin center to continue setting up and configuring the services that come with your subscriptions. - For more information about the setup wizard and the admin center **Setup** page, see [Difference between the setup wizard and the Setup page](o365-setup-wizard-and-setup-page.md). + For more information about the setup wizard and the admin center **Setup** page, see [Difference between the setup wizard and the Setup page](o365-setup-wizard-and-setup-page.md). ++## Watch: Set up business email with a new domain ++> [!VIDEO https://www.microsoft.com/videoplayer/embed/RWyVVA] ++## Steps: Set up business email with a new domain ++1. From the **How you'll sign in** page on the Microsoft 365 Business Standard sign up, choose **Create a new business email account (advanced)**. ++2. Follow the steps to buy a new domain and enter the domain name you want to use (like contoso.com). After you've completed buying your domain, you can [add users and licenses](../add-users/add-users.md) and install your Office apps in the admin center. ++## Finish setting up ++Follow the steps below to set up Outlook, Teams, OneDrive and your website. ++### Step: Set up Outlook for email ++1. On the Windows Start menu, search for Outlook, and select it. ++ (If you're using a Mac, open Outlook from the toolbar or locate it using the Finder.) ++ If you've just installed Outlook, on the Welcome page, select **Next**. ++2. Choose **File** \> **Info** \> **Add Account**. ++3. Enter your Microsoft email address and select **Connect**. ++## Watch: Set up Outlook for email ++> [!VIDEO https://www.microsoft.com/videoplayer/embed/9fe86884-8a83-42cc-bca9-61a12e6dad31?autoplay=false] + +More at [Set up Outlook for email](https://support.microsoft.com/office/f5bf0cd1-e1f3-4b0d-a022-ecab17efe86f). + +### Import email ++If you were using Outlook with another email account, you can import your previous email, calendar, and contacts into your new Microsoft account. + +1. **Export your old email** ++ In Outlook, choose **File** \> **Open & Export** \> **Import/Export**. ++ Select **Export to a File** and then follow the steps to export your Outlook Data File (.pst) and any subfolders. ++2. **Import your old email** ++ In Outlook, choose **File** \> **Open & Export** \> **Import/Export** again. ++ This time, select **Import from another program or file** and follow the steps to import the backup file you created when you exported your old email. ++## Watch: Import and redirect email ++> [!VIDEO https://www.microsoft.com/videoplayer/embed/40f7df36-9e24-44e5-8791-e9ed0dd8fd21?autoplay=false] + +More at [Import email with Outlook](https://support.microsoft.com/office/6a3771d4-4c1d-4a25-92a6-0b8e476335de). ++You can also use <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a> to import everyone's email. For more information, see [migrate multiple email accounts](/Exchange/mailbox-migration/mailbox-migration). ++## Set up Microsoft Teams and OneDrive for business ++Select the OneDrive cloud icon from your taskbar and follow the steps to move your files to your new OneDrive for Business folder. Select **Next** to set up Microsoft Teams. ++1. Open Microsoft Teams, select your profile icon, and then **Add work or school account**. Follow the steps to add your new account to Teams. ++## Use a public website ++Microsoft 365 doesn't include a public website for your business. If you want to set one up, consider using a Microsoft partner, such as GoDaddy or WIX. + +1. From the admin center, go to **Resources**, and then select **Public website**. ++2. Select **Learn more** under one of the options, and then sign up with a website partner and use their tools to set up and design your site. ++## Watch: Create your business website ++> [!VIDEO https://www.microsoft.com/videoplayer/embed/4839abc6-9323-4cbf-a79d-2907235f9ebb] ++## Invite users to join your subscription and organization ++Once you've set up your organization, you can invite other users to join your Microsoft 365 business subscription. They'll get access to all the features of the subscription. ++[Invite users to my subscription](../simplified-signup/admin-invite-business-standard.md) ++Let your users know they can follow the steps in the articles below to join your organization and subscription. ++- [Accept an email invitation](../simplified-signup/user-invite-business-standard.md) ++- [Accept an email invitation using an Outlook, Yahoo, Gmail or other account (User)](../simplified-signup/user-invite-msa-nodomain-join.md) ++## Related topics ++[Migrate data to my Microsoft 365 Business Standard subscription](../simplified-signup/migrate-data-business-standard.md) |
| admin | Signup Business Basic | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/setup/signup-business-basic.md | + + Title: "Sign up for Microsoft 365 Business Basic" +f1.keywords: +- NOCSH ++++audience: Admin +++ms.localizationpriority: high ++- M365-subscription-management +- Adm_O365 +- Adm_TOC +- Adm_O365_Setup +- TRN_SMB ++- TRN_M365B +- OKR_SMB_Videos +- AdminSurgePortfolio +- AdminTemplateSet +search.appverid: +- MET150 +- MOE150 +- BEA160 +description: "Learn how to sign up for a Microsoft 365 Business Basic subscription." +++# Sign up for Microsoft 365 Business Basic ++Want to sign up for a Microsoft 365 Business Basic? ++There are a couple of ways to get started: +- **[Buy](https://go.microsoft.com/fwlink/?linkid=2181424) Microsoft 365 Business Basic and complete the set up**. [Follow the steps below for info on how to buy](#sign-up-steps). +- **For Microsoft partners**: **Do we have a link here?** ++**Need something different?** You can: ++- [Sign up for a home or family plan](https://go.microsoft.com/fwlink/?linkid=2109398) if you're not buying for a business. ++> [!Note] +> Microsoft 365 Business Basic subscription is for commercial use and is intended for business customers. ++## Sign up steps ++To buy, and sign up for Microsoft 365 Business Basic subscription, complete the following steps. ++> [!IMPORTANT] +> The person who signs up for Microsoft 365 for business (usually the business owner) automatically becomes the technical administrator of the organization. You can add other people as admins if you want help managing your Microsoft 365 services. Check out [Assign admin roles](../add-users/assign-admin-roles.md) for more info. ++1. On the [For business page](https://go.microsoft.com/fwlink/?linkid=2181424), see what's included in Microsoft 365. Under Microsoft 365 Business Basic, select **Buy now**. +2. On the **Thank you for choosing Microsoft 365 Business Basic** page, enter an email address that you already use. This can be any address you want Microsoft to use to communicate with you during setup. It is also the address where we'll send you information about your bill and renewals. Select **Next**. +3. Select **Set up account** and enter your name, business phone number, business size, company name, and location. Select **Next**. ++> [!NOTE] +> We display your company name in the Microsoft 365 admin center. This is where you manage users, licenses and other features and services. We also include it in any internal SharePoint site URLs. ++4. Help us make sure this is you. Enter a number that we can use to reach you and select **Send Verification Code**. You'll receive a text. Enter your code and select **Verify**. ++5. Decide how you'll sign in to Microsoft 365. You can [sign in with your current personal email or [create a new account](setup-business-basic.md) by adding a domain. ++6. Select how many business licenses you want for your organization and select **Add payment method** and continue with checkout to **Place order**. ++3. On the **Confirmation details** page, we'll give you some more info about your subscription. You can now go to the Microsoft 365 admin center to add users, install Office apps, invite your team to use Microsoft 365 and more. We'll also send you an email with set up steps. ++Follow these steps to [finish setting up](setup-apps-for-business.md) your Microsoft Business Basic subscription. You can also [add a domain](../setup/add-domain.md) when you're ready. ++## Choosing the right business subscription ++When signing up for Microsoft 365 Business Basic, you have 2 options for how to get started. Evaluate three key factors to choose which best meets your needs: ++- Which apps and services do you want to use straight away? ++- How much technical skill do you have? ++- Do you need Microsoft to act as a processor for your data? ++The table below outlines each choice. ++||**Option 1** ΓÇô Sign in with Outlook, Hotmail, Yahoo, Gmail or other email account [(Simplified Sign-up)](#terms-of-service-update-for-simplified-sign-up-mode)|**Option 2** ΓÇô Add a business domain and create a new business email account | +|:--|:--|:--| +|Available apps and services <br/> |Use Word for the web, Excel for the web, PowerPoint for the web, Teams for the web and Access for the web. OneDrive and SharePoint desktop app are included. This set of apps is best for very small businesses who don't need branded email immediately, or who already use branded email from a different provider and do not intend to switch to use Microsoft Exchange. YouΓÇÖll use Outlook with your existing email account (be it outlook.com, Hotmail, Yahoo, Gmail or other). <br/> |Use Word for the web, Excel for the web, PowerPoint for the web, Teams for the web and Access for the web. OneDrive and SharePoint desktop app are included. Microsoft 365 Business Basic with Option 2 also lets you access a wide range of additional +|Required knowledge <br/> |LetΓÇÖs you get started without technical know-how. <br/> |Requires you to buy a domain, or to own a domain. You may need technical knowledge to prove ownership of the domain. <br/> | +|Data handling <br/> |Available under the Supplement to the [Microsoft Services Agreement](https://go.microsoft.com/fwlink/p/?linkid=2180702) and is best for businesses that want some remote work and collaboration tools and are comfortable with Microsoft acting as controller for your data under the [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?LinkId=521839). Subscribers to services using this option will not have access to an individualΓÇÖs user content or data until a domain is attached. Subscribers should evaluate data ownership and intellectual property rights considerations based on their needs. For example, if you are working collaboratively with other users on a document stored in their account, they may choose to make those documents inaccessible to you. As such, you should evaluate data ownership and intellectual property rights considerations accordingly. Separately, users may choose not to transfer documents in their Simplified Sign-Up account to your Domain Account subscription, even after you invite them to do so. This means their documents may also not be accessible to you even if you add a domain account later <br/> |Available under the [Microsoft Online Subscription Agreement](https://go.microsoft.com/fwlink/p/?linkid=2180430) and is best for businesses that need Microsoft to act as a processor for their data under Microsoft's [Data Protection Addendum](https://go.microsoft.com/fwlink/p/?linkid=2180314) and need our full suite of remote work and collaboration tools. Subscribers who are in regulated industries or seek more control, both over the use of the services by your employees and over processing of related data by Microsoft, should choose Option 2 and attach a domain and sign up under the Domain Account enterprise-level agreement. <br/> | ++Use these three factors to determine which of the two options is best for your business needs. ++### Option 1: Sign in with your Outlook, Hotmail, Yahoo, Gmail or other email account ++You'll sign in to Microsoft 365 with this email address. For example, alliebellew@hotmail.com. +++1. Create a password on the next page, and select **Create account** to continue. On the next page, read about how we handle your data and select whether you want Microsoft Partners to contact you. Select **Next**. ++2. Select how many Microsoft 365 Business Basic licenses you want for your organization and select **Add payment method** and continue with checkout to **Place order**. ++3. On the **Confirmation details** page, we'll give you some more info about your subscription. You can now go to the Microsoft 365 admin center to add users, install Office apps, invite your team to use Microsoft 365 and more. We'll also send you an email with set up steps for Microsoft 365 Business Basic. ++Remember this option doesn't provide branded email, admin control for use of the services by other users, or industry specific compliance support. Subscribers don't have any access or control over other usersΓÇÖ (employees) usage or documents under this option Users may choose not to transfer data created in storage such as OneDrive/Teams to your upgraded, enterprise-level domain account should you not choose option 2 immediately. ++<!--This option isn't recommended for larger businesses, including specialty industries such as healthcare or legal.--> ++### Option 2: Create a new business email account and attach a domain ++With this option, youΓÇÖll be able to use Microsoft 365 Exchange as your professional, branded email provider. All your users will have a shared domain email address. For example, their username, followed by @contoso.com. You and your users sign into Microsoft 365 with this new email address. When you follow this process (add a domain and create new business email accounts), youΓÇÖll get access to all the features provided in Microsoft 365 Business Basic. For steps on how to buy or add a domain, see [Set up Microsoft 365 Business Basic](../setup/setup-business-basic.md). +++This option provides immediate access to the full suite of features in your Microsoft 365 Business subscription but may require technical steps to be completed up front. ++If you would like to add a domain and create a business email account, you can follow the steps in the articles below: ++- [Add a domain to Microsoft 365](../setup/add-domain.md) +- [Finish setting up](setup-business-basic.md#finish-setting-up) ++## Terms of service update for Simplified Sign Up mode ++**Applies to: Existing subscribers of Microsoft 365 Business Basic who previously purchased using Simplified Sign-up mode**. ++If you previously used Simplified Sign Up mode to purchase a business subscription before October 2021 without adding a business domain you may need to accept new terms of service for uninterrupted service and usage of the Microsoft Office apps. You may be sent emails or you'll see in-app prompts when you sign in to Microsoft 365 admin Center. ++The Simplified Sign Up terms of use have been recently updated, and notably they clarify licensing and data ownership for multi-user business subscriptions. For continued service of your business subscription, you may either visit the [Microsoft 365 admin Center](https://go.microsoft.com/fwlink/?linkid=2024339) and stay using **Simplified Sign Up** (and agree to use the Microsoft Services Agreement Supplemental), or visit the [Microsoft 365 admin Center](https://go.microsoft.com/fwlink/?linkid=2024339) and add a **business domain** (and use the Microsoft Online Services Agreement). To help you choose which of these two modes best suits your needs, consult the table at the top of this article. ++Should you choose not to accept the updated terms for Simplified Sign Up or to add a business domain, your subscription will not automatically renew, and at the end of your current subscription contract, you will lose access to the Office apps. Your OneDrive data will be retained for 90 days for you to make copies of it, and then it will be deleted. ++## Frequently asked questions ++### What is a business email and what are the advantages to setting one up? ++A business email is an email that uses your own domain name. For example, if you own the domain name `contoso.com`, you can build a website using the url `www.contoso.com`, but you can also have a custom email address such as yourname@contoso.com. This is referred to as a branded business email as it gives your email a professional look. ++### How do I get a new business email address? ++There are three options for getting a business email. ++- You can use a suggested onmicrosoft.com domain for free (someone@mybusiness.onmicrosoft.com). +- You can buy a new domain to have a more compact email address (mybusinessname@contoso.com). +- You use a domain name that you already own. ++### Why might I need to verify my domain to create a business email? ++If you choose to use a domain you already own, you can use it for your email address with Microsoft 365. As part of sign up process, we ask you to verify the domain so you can send emails via Microsoft 365. This confirms that you are the owner of the domain that is sending emails with that identity, which enhances security and prevents fraudulent activity. ++### Is there a benefit to paying monthly vs annually? ++To provide customers with the greatest amount of flexibility, different payment options are available. ++- Microsoft 365 Business Basic, Apps for business, Business Standard, and Business Premium plans are available for monthly commitment payment or annual commitment payment. +- Monthly commitment payment: You pay month by month, and you can cancel at any time. +- Annual commitment payment: You sign up for a one-year subscription, but you can choose to pay month to month or pay for the entire year at the time you sign up. There is a discount for using this payment option. ++### How does recurring billing work? ++When Recurring billing is on, your subscription will continue to be billed each year on the day you subscribed. You can turn it off or back on again in the admin center if your subscription is active. Learn more at [Turn recurring billing off or on](../../commerce/subscriptions/renew-your-subscription.md#turn-recurring-billing-off-or-on). ++### What do I do if I want to change my business name? ++Contact our small business support experts who can help you change your business name. Learn more at [Get support](../get-help-support.md). ++## Set up Microsoft 365 Business Basic ++For steps on how to buy or add a domain, see [Set up Microsoft 365 Business Basic with a new or existing domain](../setup/setup-business-basic.md). + |
| admin | Admin Invite Business Standard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/simplified-signup/admin-invite-business-standard.md | Title: "Invite users to Microsoft 365 Business Standard subscription" + Title: "Invite users to a Microsoft 365 business subscription" f1.keywords: - NOCSH -# Invite users to Microsoft 365 Business Standard (Admin) +# Invite users to a Microsoft 365 for business subscription (Admin) > [!IMPORTANT]-> These steps apply to Microsoft 365 Business Standard and Microsoft 365 Apps for business. +> These steps apply to Microsoft 365 Business Standard, Microsoft 365 Business Basic and Microsoft 365 Apps for business. As the admin of a Microsoft 365 Business Standard subscription, you can invite your colleagues and coworkers to share and use your Microsoft 365 for business subscription. When you invite your colleagues and coworkers to your subscription, you share all the following features and As the admin of a Microsoft 365 Business Standard subscription, you can invite y Make sure youΓÇÖve already [signed up for Microsoft 365 Business Standard](signup-business-standard.md) or Microsoft 365 Apps for business. And make sure you've already [set up your Business Standard organization](../setup/setup-business-standard.md) or [Set up Microsoft 365 Apps for business](../setup/setup-apps-for-business.md). Once youΓÇÖve completed those steps, you can share an invite to your users. -## Share an invitation to a Microsoft 365 Business Standard subscription +## Share an invitation to a Microsoft 365 for business subscription 1. In the Microsoft 365 admin center, select **Invite people to Microsoft 365**. |
| admin | Migrate Data Business Standard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/simplified-signup/migrate-data-business-standard.md | -# Migrate data to my Microsoft 365 Business Standard subscription +# Migrate data to my Microsoft 365 for business subscription Follow the steps in this article to move your OneDrive, Outlook and Teams data to your Microsoft 365 Business Standard subscription. |
| admin | User Invite Business Standard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/simplified-signup/user-invite-business-standard.md | Title: "Accept an email invitation to Microsoft 365 Business Standard (User)" + Title: "Accept an email invitation to a Microsoft 365 for business subscription (User)" f1.keywords: - NOCSH -description: "Accept invite to join a Microsoft 365 Business Standard organization" +description: "Accept invite to join a Microsoft 365 for business organization" -# Accept an email invitation to a Microsoft 365 Business Standard subscription (User) +# Accept an email invitation to a Microsoft 365 for business subscription (User) ++> [!IMPORTANT] +> These steps apply to Microsoft 365 Business Standard, Microsoft 365 Business Basic and Microsoft 365 Apps for business. When youΓÇÖre already using Microsoft 365 Business with a Gmail, Outlook, Yahoo (or similar) email address, someone (for example your administrator or business owner) may invite you to upgrade Microsoft 365 to start using professional branded email. In this scenario, youΓÇÖll be switching email address and learning how to upgrade. When youΓÇÖre already using Microsoft 365 Business with a Gmail, Outlook, Yahoo If youΓÇÖre an admin of an organization where users are still using Gmail, Outlook, Yahoo or similar email addresses, and youΓÇÖre looking how to set up branded email, check out these steps instead: [Add a domain to Microsoft 365](../setup/add-domain.md) and [Set up your organization with email and cloud storage](../setup/setup-business-standard.md#finish-setting-up). > [!IMPORTANT]-> If youΓÇÖre an admin and youΓÇÖre looking for steps on how to send a user an invite to your Microsoft 365 Business Standard subscription, check out [Invite users to Microsoft 365 Business Standard (Admin)](admin-invite-business-standard.md). +> If youΓÇÖre an admin and youΓÇÖre looking for steps on how to send a user an invite to your Microsoft 365 for business subscription, check out [Invite users to Microsoft 365 Business Standard (Admin)](admin-invite-business-standard.md). -## Join a business Microsoft 365 Business Standard organization +## Join a Microsoft 365 for business organization Make sure you have your current account sign in details before you start these steps. Make sure you have your current account sign in details before you start these s 8. On the **Add new account to Microsoft Teams** page, follow the steps to set up Teams. Select **I'm done** when you're complete. -### Next steps - Migrate your data to Microsoft 365 Business Standard +### Next steps - Migrate your data to Microsoft 365 for business -Follow the steps in the [Migrate data to my Microsoft 365 Business Standard subscription](migrate-data-business-standard.md) to move your OneDrive, Outlook and Teams data. +Follow the steps in the [Migrate data to my Microsoft 365 for business subscription](migrate-data-business-standard.md) to move your OneDrive, Outlook and Teams data. ### No data to migrate? Contact our small business support experts who can help you upgrade your Microso ### What happens to my data and account when I upgrade? -Your data will remain in your old account, nothing will be deleted. You will be still able to sign in to your old Gmail, Outlook, Yahoo, or other email account like you did before. You should now move your work files to your new work account. Learn how to do that here: [Migrate data to my Microsoft 365 Business Standard subscription](migrate-data-business-standard.md). +Your data will remain in your old account, nothing will be deleted. You will be still able to sign in to your old Gmail, Outlook, Yahoo, or other email account like you did before. You should now move your work files to your new work account. Learn how to do that here: [Migrate data to my Microsoft 365 for business subscription](migrate-data-business-standard.md). ### How can I copy data to my business account? Your data will remain in your old account, nothing will be deleted. You will be ### Why does it say my admin now handles my data? -When using an upgraded Microsoft 365 Business account, your documents, email and data that you create within Microsoft Office (and within other apps in Microsoft 365 Business Standard) will be owned by the technical administrator in your organization. For example, the person who sent you the invitation email or your business owner. +When using an upgraded Microsoft 365 Business account, your documents, email and data that you create within Microsoft Office (and within other apps in Microsoft 365 for business subscriptions) will be owned by the technical administrator in your organization. For example, the person who sent you the invitation email or your business owner. ### How do I get started with my new account? |
| admin | User Invite Msa Nodomain Join | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/simplified-signup/user-invite-msa-nodomain-join.md | Title: "Accept an email invitation to a Microsoft 365 Business Standard subscription organization using an Outlook, Yahoo, Gmail or other account (User)" + Title: "Accept an email invitation to a Microsoft 365 for business subscription organization using an Outlook, Yahoo, Gmail or other account (User)" f1.keywords: - NOCSH -# Accept an email invitation to a Microsoft 365 Business Standard subscription organization using an Outlook, Yahoo, Gmail or other account (User) +# Accept an email invitation to a Microsoft 365 for business subscription organization using an Outlook, Yahoo, Gmail or other account (User) ++> [!IMPORTANT] +> These steps apply to Microsoft 365 Business Standard, Microsoft 365 Business Basic and Microsoft 365 Apps for business. When someone adds you to a Microsoft 365 for business organization, you'll get an email invitation with steps on how to join. In this scenario, you're joining an organization that doesn't have a different professional email for users. You'll sign in with your regular email account. > [!IMPORTANT]-> If youΓÇÖre an admin and youΓÇÖre looking for steps on how to send a user an invite to your Microsoft 365 Business Standard subscription, check out [Invite users to Microsoft 365 Business Standard (Admin)](admin-invite-business-standard.md). +> If youΓÇÖre an admin and youΓÇÖre looking for steps on how to send a user an invite to your Microsoft 365 for business subscription, check out [Invite users to Microsoft 365 for business (Admin)](admin-invite-business-standard.md). -## Join a Microsoft 365 Business Standard organization using an Outlook, Yahoo, Gmail or other account +## Join a Microsoft 365 for business organization using an Outlook, Yahoo, Gmail or other account Your email looks like this to set up your user account. When you get this email, you'll have to complete a few steps before you can start using your new user account. 1. From the invitation email, select **Accept**. |
| compliance | Compliance Easy Trials Compliance Playbook | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/compliance-easy-trials-compliance-playbook.md | To fully leverage the functionality of Insider Risk Management, we recommend set **Identify regulatory compliance policy violations** -Microsoft Purview Communication Compliance helps organizations detect explicit regulatory compliance violations such as SEC or FINRA obligations, including inappropriate sharing of sensitive or confidential information. With built in workflows, the solution can help you investigate and remediate possible regulatory compliance violations. Built with privacy by design, this solution has usernames pseudonymized by default, role-based access controls are built-in, investigators must be explicitly added by an administrator to a policy, and audit logs are in place to help ensure user-level privacy. +Microsoft Purview Communication Compliance provides the tools to help organizations detect regulatory compliance violations (e.g. SEC or FINRA), such as sensitive or confidential information, harassing or threatening language, and sharing of adult content. Built with privacy by design, usernames are pseudonymized by default, role-based access controls are built in, investigators are opted in by an admin, and audit logs are in place to ensure user-level privacy. ### Step 1: Enable permissions for communication compliance |
| compliance | Dlp Policy Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-policy-reference.md | The available context options change depending on which location you choose. If ##### Conditions Devices supports - Content contains-- (preview) Document or attachment is password protected/file is encrypted. (.pdf, Office files are fully supported. Only pgp encrypted files are supported)-- (preview) Content doesn't have sensitivity label applied.+- (preview) Document or attachment is password protected (.pdf, Office files and Symantec PGP encrypted files are fully supported).This predicate doesnΓÇÖt detect digital rights managed (DRM) encrypted or permission protected files. +- (preview) Content is not labeled (.pdf, Office files are fully supported). This predicate detects content that doesn't have a sensitivity label applied. To help ensure only supported file types are detected, you should use this condition with the **File extension is** or **File type is** conditions. - (preview) The user accessed a sensitive website from Edge. See, [Scenario 6 Monitor or restrict user activities on sensitive service domains (preview)](endpoint-dlp-using.md#scenario-6-monitor-or-restrict-user-activities-on-sensitive-service-domains) for more information. - File extension is - File type is |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | For a more consistent label experience with meaningful reporting, provide approp > [!NOTE] > If users manually remove encryption from a labeled document that's stored in SharePoint or OneDrive and you've [enabled sensitivity labels for Office files in SharePoint and OneDrive](sensitivity-labels-sharepoint-onedrive-files.md), the label encryption will be automatically restored the next time the document is accessed or downloaded. +## Encryption-based label matching for documents -## Apply sensitivity labels to files, emails, and attachments +When a document has been encrypted with administrator-defined permissions, the encryption information includes information about a matching sensitivity label. As a result, when a user opens that document in an Office app, the matching label is displayed in the Office app and persists if the document is saved. -Users can apply just one label at a time for each document or email. +In this scenario, the matching sensitivity label can label an unlabeled document, and replace an existing label that doesn't apply encryption. For example, the **General** label is replaced with **Confidential / All Employees**. Content markings from the matching label aren't automatically applied, unless the document was previously unlabeled and you're using the AIP Add-in. -When you label an email message that has attachments, the attachments inherit the label only if the label that you apply to the email message applies encryption and the attachment is an Office document isn't already encrypted. Because the inherited label applies encryption, the attachment becomes newly encrypted. +This scenario helps to move older encryption solutions from protection templates to sensitivity labels that apply encryption. -An attachment doesn't inherit the labels from the email message when the label applied to the email message doesn't apply encryption or the attachment is already encrypted. +However, you will also see this behavior with a labeling scenario for email attachments when they are opened by the recipient. For example: -Examples of label inheritance, where the label **Confidential** applies encryption and the label **General** doesn't apply encryption: +1. A user creates an email and attaches an unencrypted Office document, and then applies a label to the email. + + The label applies encryption with permissions that are set by the administrator, rather than the Do Not Forward or Encrypt-Only options. For example, for the label configuration, the admin selects **Assign permissions now**, and specifies all employees have read access. ++2. When the email is sent, the [attachment automatically inherits the encryption, but not the label](encryption-sensitivity-labels.md#email-attachments-for-encrypted-email-messages). -- A user creates a new email message and applies the **Confidential** label to this message. They then add a Word document that isn't labeled or encrypted. As a result of inheritance, the document is newly labeled **Confidential** and now has encryption applied from that label.+3. When a recipient in the same tenant opens the encrypted document, a matching label for the admin-defined permissions is automatically displayed for the document, and persists if the document is saved. + + As an auditing event that's displayed in Activity Explorer, this user applied the label, not the email sender. -- A user creates a new email message and applies the **Confidential** label to this message. They then add a Word document that is labeled **General** and this file isn't encrypted. As a result of inheritance, the document gets relabeled as **Confidential** and now has encryption applied from that label.+Encryption-based label matching works only within the tenant, for admin-defined permissions, and the matching sensitivity label must be published to the user who opens the document. ## Sensitivity label compatibility |
| contentunderstanding | Apply A Model | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/apply-a-model.md | While an applied model processes all files and folder content uploaded to the do 3. The files and folders you selected will be added to the queue to be processed. > [!NOTE]- > You'll receive a message indicating how long classification might take. If you've selected only files, classification might take up to 30 minutes. If you've selected one or more folders, classification might take up to 24 hours. + > If you've selected one or more folders or are migrating a large set of files, classification might take up to 24 hours. ### Classification Date field |
| contentunderstanding | Document Understanding Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/document-understanding-overview.md | OCR processing works best on documents that meet the following requirements: - Must use the Latin alphabet (English characters). -> [!NOTE] -> AI Builder doesn't currently support the following types of form processing input data: -> -> - Check boxes or radio buttons -> - Signatures -> - Fillable PDFs - ### Supported file types Document understanding models support the following file types: |
| security | Whats New In Microsoft Defender Vulnerability Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/whats-new-in-microsoft-defender-vulnerability-management.md | +## August 2022 +- Defender Vulnerability Management is now supported for Amazon Linux 2 and Fedora 33 or higher. ++- [Broswer extensions APIs](../defender-endpoint/get-assessment-browser-extensions.md)</br> + You can now use the new broswer extenstions APIs to view all browser extensions installed in your organization, including installed versions, permissions requested, and associated risk. ++- [Extended software inventory API support for non product code software](../defender-endpoint/get-assessment-non-cpe-software-inventory.md)</br> + A new API is now available and returns all the data for installed software that doesn't have a [Common Platform Enumeration(CPE)](https://nvd.nist.gov/products/cpe). The information returned by this API, along with the information returned by the Export software inventory assessment API, for software that does have a CPE, gives you full visibility into the software installed across your organization and the devices itΓÇÖs installed on. + ## May 2022 - **[Security baselines assessment](tvm-security-baselines.md)**: Create and manage baseline profiles to monitor the posture of your devices against their desired security state. |
| security | About Defender For Office 365 Trial | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/about-defender-for-office-365-trial.md | - Title: "About the Microsoft Defender for Office 365 trial"-------- MET150--- M365-security-compliance-- m365initiative-defender-office365--- seo-marvel-apr2020- -description: "Admins can learn about the trial mode of Microsoft Defender for Office 365" ---# About the Microsoft Defender for Office 365 trial --> [!IMPORTANT] -> Get started quickly with our easy to use [Trial playbook for Microsoft Defender for Office 365](trial-playbook-defender-for-office-365.md). This playbook will help you make the most of your free trial by showing you how to safeguard your organization with Microsoft Defender for Office 365. --Microsoft Defender for Office 365 safeguards your organization against malicious threats that are posed by email messages, links (URLs), and collaboration tools. Defender for Office 365 includes: --- **Threat protection policies**: Define threat-protection policies to set the appropriate level of protection for your organization.-- **Reports**: View real-time reports to monitor Defender for Office 365 performance in your organization.-- **Threat investigation and response capabilities**: Use leading-edge tools to investigate, understand, simulate, and prevent threats.-- **Automated investigation and response capabilities**: Save time and effort investigating and mitigating threats.--A Microsoft Defender for Office 365 trial is an easy way to try out the capabilities of Defender for Office 365 Plan 2 for free, after only a few clicks. These high level capabilities are described in the following table: --|Feature|Description| -||| -|[Exclusive settings in anti-phishing policies](set-up-anti-phishing-policies.md#exclusive-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)|Get user impersonation protection, domain impersonation protection, mailbox intelligence, and advanced phishing thresholds.| -|[Safe Attachments](safe-attachments.md)|Inspect email attachments and other files in a controlled detonation environment to catch new and evasive malware.| -|[Safe Links](safe-links.md)|Perform time-of-click checks to ensure URLs that might have passed initial inspection have not been weaponized.| -|[Threat Trackers](threat-trackers.md)<sup>\*</sup>|Use informative widgets and views to identify cybersecurity issues that might impact your organization.| -|[Threat Explorer](threat-explorer.md)<sup>\*</sup>|Hunt with near real-time information about threats in your Office 365 email.| -|[Automated investigation and response (AIR)](office-365-air.md)<sup>\*</sup>|Automatically locate and remediate threat objects as alerts are triggered.| -|[Attack simulation training](attack-simulation-training.md)<sup>\*</sup>|Train your users to identify phishing attacks and respond appropriately.| -|[Campaign Views](campaigns.md)<sup>\*</sup>|Investigate and respond to large-scale malicious email activity.| -|[Reports using Defender for Office 365 capabilities](view-reports-for-mdo.md)|View reports including threat protection status, URL threat protection, mail latency, and more.| -|[Priority account protection](/microsoft-365/admin/setup/priority-accounts)<sup>\*</sup>|Users that you identify as Priority accounts are tagged in alerts, reports, and investigations so they stand out. You can also use the Priority tag in filters.| --<sup>\*</sup> This feature is exclusive to Defender for Office 365 Plan 2. --## Set up a Defender for Office 365 trial --A trial allows organizations to easily set up and configure the Defender for Office 365 capabilities. During setup, policies that are exclusive to Defender for Office 365 (specifically, [Safe Attachments for email messages](safe-attachments.md), [Safe Links for email messages and Microsoft Teams](safe-links.md), and [impersonation protection in anti-phishing policies](set-up-anti-phishing-policies.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)) are applied using the Standard template for [preset security policies](preset-security-policies.md). --By default, these policies are scoped to all users in the organization, but during or after the setup of the trial, you can change the policy assignment to specific users. --> [!NOTE] -> Your existing anti-spam policies are likely configured with the action **Move message to Junk Email folder** for the high confidence spam verdict in anti-spam policies. The Standard template for preset security policies uses the action **Quarantine message** for high confidence spam, and preset security policies are always applied before custom anti-spam policies or the default anti-spam policy. For more information about default, Standard, and Strict settings, see [Recommended settings for EOP and Microsoft Defender for Office 365 security](recommended-settings-for-eop-and-office365.md). --Other workloads are also available for protection (for example, [Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](mdo-for-spo-odb-and-teams.md) and [Safe Links for supported Office apps](safe-links.md#safe-links-settings-for-office-apps). --During the setup of the trial, response functionality that's exclusive to Defender for Office 365 Plan 2 (for example, [AIR](office-365-air.md) and [Threat Explorer](threat-explorer.md) is also set up for the entire organization. No policy scoping is required. --## Licensing --As part of the trial setup, the Defender for Office 365 licenses are automatically applied to the organization. The licenses are free of charge for the first 90 days. --The licensing card for the trial shows the following information: ---- **Usage type** section:- - **Trial**: The number of trial Defender for Office 365 licenses that are available for you to use. -- > [!NOTE] - > In other locations, you might see the value 300 for your number of available trial licenses. This value is incorrect (unless your organization happens to have exactly 300 users). The number of trial licenses that are available to you corresponds the size of your organization, not the arbitrary value 300. -- - **Paid**: The number of paid Defender for Office 365 licenses (if any). --- **Usage** section: How many of your users are covered by Defender for Office 365 policies.- - **Detection & response only**: The total number of users that are included in the following scenarios: - - During the trial, you scoped the policies to specific users. - - You have custom polices that are scoped to specific users. - - **Full protection**: The total number of users that are protected by Defender for Office 365 Plan 2 features (AIR, Threat Explorer, Attack simulation training, etc.). --For pricing information, see [Microsoft Defender for Office 365](https://www.microsoft.com/security/business/siem-and-xdr/microsoft-defender-office-365). --## Permissions --To start or end the trial, you need to be a member of the **Global Administrator** or **Security Administrator** roles in Azure Active Directory. For details, see [About admin roles](../../admin/add-users/about-admin-roles.md). --## Additional information --After you start the trial, it might take up to 2 hours for the changes and updates to be available. And, admins must log out and log back in to see the changes. --## Availability --The Defender for Office 365 trial is gradually rolling out to existing customers who meet specific criteria and who don't have existing Defender for Office 365 Plan 2 licenses (included in their subscription or as an add-on). --## Terms and conditions --For more information, see [Microsoft Defender for Office 365 Trial Terms & Conditions](defender-for-office-365-trial-terms-and-conditions.md). --## Frequently asked questions --### Q: How do I extend the trial? --A: See [Extend your trial](/microsoft-365/commerce/try-or-buy-microsoft-365#extend-your-trial). --### Q: What happens to my data after the trial expires? --A: After your trial expires, you'll have access to your trial data (data from features in Defender for Office 365 that you didn't have previously) for 30 days. After this 30 day period, all policies and data that were associated with the Defender for Office 365 trial will be deleted. --### Q: How many times can I use the Defender for Office 365 trial in my organization? --A: A maximum of 2 times. If your first trial expires, you need to wait at least 30 days after the expiration date before you can enroll in the Defender for Office 365 trial again. After your second trial, you can't enroll in another trial. --## Learn more about Defender for Office 365 --Defender for Office 365 helps organizations secure their enterprise by offering a comprehensive slate of capabilities. --You can also learn more about Defender for Office 365 at this [interactive guide](https://aka.ms/MS365D.InteractiveGuide). ---### Prevention --A robust filtering stack prevents a wide variety of volume-based and targeted attacks including business email compromise, credential phishing, ransomware, and advanced malware. --- [Anti-phishing policies: Exclusive settings in Defender for Office 365](set-up-anti-phishing-policies.md#exclusive-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)-- [Safe Attachments](safe-attachments.md)-- [Safe Links](safe-links.md)--### Detection --Industry-leading AI detects malicious and suspicious content and correlates attack patterns to identify campaigns designed to evade protection. --- [Campaign Views in Microsoft Defender for Office 365](campaigns.md)--### Investigation and hunting --Powerful experiences help identify, prioritize, and investigate threats, with advanced hunting capabilities to track attacks across Office 365. --- [Threat Explorer and Real-time detections](threat-explorer.md)-- [Real-time reports in Defender for Office 365](view-reports-for-mdo.md)-- [Threat Trackers - New and Noteworthy](threat-trackers.md)-- Integration with [Microsoft 365 Defender](../defender/microsoft-365-defender.md)--### Response and remediation --Extensive incident response and automation capabilities amplify your security team's effectiveness and efficiency. --- [Automated investigation and response (AIR) in Microsoft Defender for Office 365](office-365-air.md)--### Awareness and training --Rich simulation and training capabilities along with integrated experiences within client applications build user awareness. --- [Get started using Attack simulation training](attack-simulation-training-get-started.md)--### Security posture --Recommended templates and configuration insights help customers get and stay secure. --- [Preset security policies in EOP and Microsoft Defender for Office 365](preset-security-policies.md)-- [Configuration analyzer for protection policies in EOP and Microsoft Defender for Office 365](configuration-analyzer-for-security-policies.md).--## Give feedback --Your feedback helps us get better at protecting your environment from advanced attacks. Share your experience and impressions of product capabilities and trial results. |
| security | Admin Submission | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/admin-submission.md | Watch this short video to learn how to use admin submissions in Microsoft Defend When you're finished, click **Submit**, and then click **Done**. -> :::image type="content" source="../../media/admin-submission-email-block.png" alt-text="Submit a false negative (bad) email to Microsoft for analysis on the Submissions page in the Defender portal." lightbox="../../media/admin-submission-email-block.png"::: > [!NOTE] > For messages that were incorrectly blocked by [spoof intelligence](learn-about-spoof-intelligence.md), a block entry for the domain pair is not created in the Tenant Allow/Block List. > > For messages that were incorrectly blocked by [domain or user impersonation protection](set-up-anti-phishing-policies.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365), a block entry for the domain or sender is not created in the Tenant Allow/Block List. Instead, the domain or sender is added to the **Trusted senders and domains section** in the [anti-phishing policy](configure-mdo-anti-phishing-policies.md#use-the-microsoft-365-defender-portal-to-modify-anti-phishing-policies) that detected the message.-> -> To report a file as **Should not have been blocked (False positive)**, see [Use the Microsoft 365 Defender portal to create allow entries for domains and email addresses in the Submissions portal](allow-block-email-spoof.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-domains-and-email-addresses-in-the-submissions-portal). ## Report questionable email attachments to Microsoft Watch this short video to learn how to use admin submissions in Microsoft Defend When you're finished, click **Submit**, and then click **Done**. -> :::image type="content" source="../../media/admin-submission-file-block.png" alt-text="Submit a false negative (bad) email attachment to Microsoft for analysis on the Submissions page in the Defender portal." lightbox="../../media/admin-submission-file-block.png"::: -- > [!NOTE] - > To report a file as **Should not have been blocked (False positive)**, see [Use the Microsoft 365 Defender portal to create allow entries for files in the Submissions portal](allow-block-files.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-files-in-the-submissions-portal). ## Report questionable URLs to Microsoft Watch this short video to learn how to use admin submissions in Microsoft Defend When you're finished, click **Submit**, and then click **Done**. -> :::image type="content" source="../../media/admin-submission-url-block.png" alt-text="Submit a false negative (bad) URL to Microsoft for analysis on the Submissions page in the Defender portal." lightbox="../../media/admin-submission-url-block.png"::: ++## Report good email to Microsoft ++1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. ++2. On the **Submissions** page, verify that the **Emails** tab is selected. ++3. On the **Emails** tab, click  **Submit to Microsoft for analysis**. ++4. In the **Submit to Microsoft for analysis** flyout that appears, enter the following information: ++ - **Select the submission type**: Verify the value **Email** is selected. ++ - **Add the network message ID or upload the email file**: Select one of the following options: ++ - **Add the email network message ID**: This is a GUID value that's available in the **X-MS-Exchange-Organization-Network-Message-Id** header in the message or in the **X-MS-Office365-Filtering-Correlation-Id** header in quarantined messages. ++ - **Upload the email file (.msg or .eml)**: Click **Browse files**. In the dialog that opens, find and select the .eml or .msg file, and then click **Open**. ++ - **Choose a recipient who had an issue**: Specify the recipient that you would like to run a policy check against. The policy check will determine if the email was blocked due to user or organization policies. ++ - **Select a reason for submitting to Microsoft**: Select **Should not have been blocked (False positive)**, and then configure the following settings: ++ - **Allow emails with similar attributes (URL, sender, etc.)**: Turn on this setting . - > [!NOTE] - > To report a URL as **Should not have been blocked (False positive)**, see [Use the Microsoft 365 Defender portal to create allow entries for URLs in the Submissions portal](allow-block-urls.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-urls-in-the-submissions-portal). + - **Remove allow entry after**: The default value is **30 days**, but you can select from the following values: + - **1 day** + - **7 days** + - **30 days** + - **Specific date**: The maximum value is 30 days from today. ++ For spoofed senders, this value is meaningless, because entries for spoofed senders never expire. ++ - **Allow entry note**: Enter optional information about why you're allowing this email. ++ For spoofed senders, any value you enter here is not shown in the allow entry on the **Spoofed senders** tab on the **Tenant Allow/Block List**. ++ When you're finished, click **Submit**, and then click **Done**. ++ :::image type="content" source="../../media/admin-submission-email-allow.png" alt-text="Submit a false positive (good) email to Microsoft for analysis on the Submissions page in the Defender portal." lightbox="../../media/admin-submission-email-allow.png"::: ++After a few moments, the allow entry will appear on the **Domains & addresses** or **Spoofed senders** tab on the **Tenant Allow/Block List** page. ++> [!NOTE] +> +> - When you override the verdict in the spoof intelligence insight, the spoofed sender becomes a manual allow or block entry that only appears on the **Spoofed senders** tab in the Tenant Allow/Block List. +> - If the sender has not already been blocked, submitting the email message to Microsoft won't create an allow entry in the Tenant Allow/Block List. +> - Allows are added during mail flow, based on which filters determined the message to be malicious. For example, if the sender and a URL in the message were determined to be bad, an allow entry is created for the sender, and an allow entry is created for the URL. +> - When that entity (domain or email address, URL, file) is encountered again, all filters associated with that entity are skipped. +> - During mail flow, if messages from the domain or email address pass other checks in the filtering stack, the messages will be delivered. For example, if [email authentication](email-validation-and-authentication.md) passes, a message from a sender in the allow entry will be delivered. ++## Report good email attachments to Microsoft ++1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. ++2. On the **Submissions** page, select the **Email attachments** tab. ++3. On the **Email attachments** tab, click  **Submit to Microsoft for analysis**. ++4. On the **Submit to Microsoft for analysis** flyout that appears, enter the following information: ++ - **Select the submission type**: Verify the value **Email attachment** is selected. ++ - **File**: Click **Browse files** to find and select the file to submit. ++ - **Select a reason for submitting to Microsoft**: Select **Should not have been blocked (False positive)**, and then configure the following settings: ++ - **Allow this file**: Turn on this setting . ++ - **Remove allow entry after**: The default value is **30 days**, but you can select from the following values: + - **1 day** + - **7 days** + - **30 days** + - **Specific date**: The maximum value is 30 days from today. ++ - **Allow entry note**: Enter optional information about why you're allowing this file. ++ When you're finished, click **Submit**, and then click **Done**. ++ :::image type="content" source="../../media/admin-submission-file-allow.png" alt-text="Submit a false positive (good) email attachment to Microsoft for analysis on the Submissions page in the Defender portal." lightbox="../../media/admin-submission-file-allow.png"::: ++After a few moments, an allow entry will appear on the **Files** tab on the **Tenant Allow/Block List** page. ++> [!NOTE] +> When the file is encountered again, it's not sent for [Safe Attachments](safe-attachments.md) detonation or file reputation checks, and all other file-based filters are skipped. During mail flow, if messages containing the file pass other non-file checks in the filtering stack, the messages will be delivered. ++## Report good URLs to Microsoft ++1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. ++2. On the **Submissions** page, select the **URLs** tab ++3. On the **URLs** tab, click  **Submit to Microsoft for analysis**. ++4. In the **Submit to Microsoft for analysis** flyout that appears, enter the following information: ++ - **Select the submission type**: Verify the value **URL** is selected. ++ - **URL**: Enter the full URL (for example, `https://www.fabrikam.com/marketing.html`), and then select it in the box that appears. ++ - **Select a reason for submitting to Microsoft**: Select **Should not have been blocked (False positive)**, and then configure the following settings: ++ - **Allow this URL**: Turn on this setting . ++ - **Remove allow entry after**: The default value is **30 days**, but you can select from the following values: + - **1 day** + - **7 days** + - **30 days** + - **Specific date**: The maximum value is 30 days from today. ++ - **Allow entry note**: Enter optional information about why you're allowing this URL. ++ When you're finished, click **Submit**, and then click **Done**. ++ :::image type="content" source="../../media/admin-submission-url-allow.png" alt-text="Submit a false positive (good) URL to Microsoft for analysis on the Submissions page in the Defender portal." lightbox="../../media/admin-submission-url-allow.png"::: ++After a few moments, an allow entry will appear on the **URL** tab on the **Tenant Allow/Block List** page. For more information about the Tenant Allow/Block List, see [Manage your allows and blocks in the Tenant Allow/Block List](manage-tenant-allow-block-list.md). ++> [!NOTE] +> +> - When the URL is detected again, it's not sent for [Safe Links](safe-links.md) detonation or URL reputation checks, and all other URL-based filters are skipped. +> - During mail flow, if messages containing the URL pass other non-URL checks in the filtering stack, the messages will be delivered. ## View email admin submissions to Microsoft |
| security | Allow Block Email Spoof | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/allow-block-email-spoof.md | To create block entries for spoofed senders, see the [Use the Microsoft 365 Defe #### Use the Microsoft 365 Defender portal to create block entries for domains and email addresses in the Submissions portal -When you use the Submissions portal at <https://security.microsoft.com/reportsubmission> to report email messages as **Should have been blocked (False negative)**, you can select **Block all emails from this recipient** to add a block entry for the domain or sender in the Tenant Allow/Block List. +When you use the Submissions portal at <https://security.microsoft.com/reportsubmission> to report email messages as **Should have been blocked (False negative)**, you can select **Block all emails from this recipient** to add a block entry for the sender on the **Domains & addresses** tab in the Tenant Allow/Block List. For instructions, see [Report questionable email to Microsoft](admin-submission.md#report-questionable-email-to-microsoft). For detailed syntax and parameter information, see [New-TenantAllowBlockListItem ### Use the Microsoft 365 Defender portal to create allow entries for domains and email addresses in the Submissions portal -You can't create allow entries for domains and email addresses directly in the Tenant Allow/Block List. Instead, you use the Submissions portal at <https://security.microsoft.com/reportsubmission> to report the message as a false positive. For more information about admin submissions, see [Use the Submissions portal to submit suspected spam, phish, URLs, legitimate email getting blocked, and email attachments to Microsoft](admin-submission.md). +You can't create allow entries for domains and email addresses directly in the Tenant Allow/Block List. Instead, you use the Submissions portal at <https://security.microsoft.com/reportsubmission> to report the message as a false positive, which also adds an allow entry for the sender on the **Domains & addresses** tab in the Tenant Allow/Block List. ++For instructions, see [Report good email to Microsoft](admin-submission.md#report-good-email-to-microsoft). > [!NOTE] > Because Microsoft manages allow entries for you, unneeded allow entries for domains and email addresses will be removed. This behavior protects your organization and helps prevent misconfigured allow entries. If you disagree with the verdict, you might need to open a support case to help determine why a message is still considered bad. You can't create allow entries for domains and email addresses directly in the T > > To create allow entries for spoofed senders, see the [Create allow entries for spoofed senders](#create-allow-entries-for-spoofed-senders) section later in this article. -1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. --2. On the **Submissions** page, verify that the **Emails** tab is selected. --3. On the **Emails** tab, click  **Submit to Microsoft for analysis**. --4. In the **Submit to Microsoft for analysis** flyout that appears, enter the following information: -- - **Select the submission type**: Verify the value **Email** is selected. -- - **Add the network message ID or upload the email file**: Select one of the following options: -- - **Add the email network message ID**: This is a GUID value that's available in the **X-MS-Exchange-Organization-Network-Message-Id** header in the message or in the **X-MS-Office365-Filtering-Correlation-Id** header in quarantined messages. -- - **Upload the email file (.msg or .eml)**: Click **Browse files**. In the dialog that opens, find and select the .eml or .msg file, and then click **Open**. -- - **Choose a recipient who had an issue**: Specify the recipient that you would like to run a policy check against. The policy check will determine if the email was blocked due to user or organization policies. -- - **Select a reason for submitting to Microsoft**: Select **Should not have been blocked (False positive)**, and then configure the following settings: -- - **Allow emails with similar attributes (URL, sender, etc.)**: Turn on this setting . -- - **Remove allow entry after**: The default value is **30 days**, but you can select from the following values: - - **1 day** - - **7 days** - - **30 days** - - **Specific date**: The maximum value is 30 days from today. -- - **Allow entry note**: Enter optional information about why you're allowing this email. -- When you're finished, click **Submit**, and then click **Done**. -- :::image type="content" source="../../media/admin-submission-email-allow.png" alt-text="Submit a false positive (good) email to Microsoft for analysis on the Submissions page in the Defender portal." lightbox="../../media/admin-submission-email-allow.png"::: --5. After a few moments, the allow entry will appear on the **Domains & addresses** tab on the **Tenant Allow/Block List** page. --> [!NOTE] -> -> - Allows are added during mail flow, based on which filters determined the message to be malicious. For example, if the sender and a URL in the message were determined to be bad, an allow entry is created for the sender, and an allow entry is created for the URL. -> - When that entity (domain or email address, URL, file) is encountered again, all filters associated with that entity are skipped. -> - During mail flow, if messages from the domain or email address pass other checks in the filtering stack, the messages will be delivered. For example, if [email authentication](email-validation-and-authentication.md) passes, a message from a sender in the allow entry will be delivered. - ### Use the Microsoft 365 Defender portal to view allow or block entries for domains and email addresses in the Tenant Allow/Block List 1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Tenant Allow/Block Lists** in the **Rules** section. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>. For detailed syntax and parameter information, see [Get-TenantAllowBlockListItem ### Use the Microsoft 365 Defender portal to modify allow or block entries for domains and email addresses in the Tenant Allow/Block List -When you modify an allow or block entry for domains and email addresses in the Tenant Allow/Block list, you can only modify the expiration date and notes. +When you modify allow or block entries for domains and email addresses in the Tenant Allow/Block list, you can only modify the expiration date and notes. 1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>. You have the following options to create block entries for spoofed senders: #### Use the Microsoft 365 Defender portal to create allow entries for spoofed senders in the Submissions portal -Submitting messages that were blocked by [spoof intelligence](learn-about-spoof-intelligence.md) to Microsoft from the **Submissions** page adds the sender as an allow entry on the **Spoofed senders** tab in Tenant Allow/Block List. +Submitting messages that were blocked by [spoof intelligence](learn-about-spoof-intelligence.md) to Microsoft in the **Submissions** portal at <https://security.microsoft.com/reportsubmission> adds the sender as an allow entry for the sender on the **Spoofed senders** tab in Tenant Allow/Block List. ++For instructions, see [Report good email to Microsoft](admin-submission.md#report-good-email-to-microsoft). > [!NOTE] > When you override the verdict in the spoof intelligence insight, the spoofed sender becomes a manual allow or block entry that only appears on the **Spoofed senders** tab in the Tenant Allow/Block List. > > If the sender has not been blocked by spoof intelligence, submitting the email message to Microsoft won't create an allow entry in the Tenant Allow/Block List. -The instructions to report the message are nearly identical to the steps in [Use the Microsoft 365 Defender portal to create allow entries for domains and email addresses in the Submissions portal](#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-domains-and-email-addresses-in-the-submissions-portal). --The only differences are: --- The **Remove allow entry after** setting in Step 4 is meaningless, because entries for spoofed senders never expire.-- The **Allow entry note** setting in Step 4 doesn't apply to entries for spoofed senders in the Tenant Allow/Block List.- #### Use the Microsoft 365 Defender portal to create allow entries for spoofed senders in the Tenant Allow/Block List In the Tenant Allow/Block List, you can create allow entries for spoofed senders before they're detected and blocked by [spoof intelligence](learn-about-spoof-intelligence.md). |
| security | Allow Block Files | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/allow-block-files.md | You have the following options to create block entries for files: ### Use the Microsoft 365 Defender portal to create block entries for files in the Submissions portal -When you use the Submissions portal at <https://security.microsoft.com/reportsubmission> to report files as **Should have been blocked (False negative)**, you can select **Block this file** to add a block entry for the file in the Tenant Allow/Block List. +When you use the Submissions portal at <https://security.microsoft.com/reportsubmission> to report files as **Should have been blocked (False negative)**, you can select **Block this file** to add a block entry on the **Files** tab in the Tenant Allow/Block List. For instructions, see [Report questionable email attachments to Microsoft](admin-submission.md#report-questionable-email-attachments-to-microsoft). In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online- New-TenantAllowBlockListItems -ListType <FileHash> -Block -Entries "Value1","Value2",..."ValueN" <-ExpirationDate Date | -NoExpiration> [-Notes <String>] ``` -This example adds a block file entry for the specified files that never expires. +This example adds a block entry for the specified files that never expires. ```powershell New-TenantAllowBlockListItems -ListType FileHash -Block -Entries "768a813668695ef2483b2bde7cf5d1b2db0423a0d3e63e498f3ab6f2eb13ea3","2c0a35409ff0873cfa28b70b8224e9aca2362241c1f0ed6f622fef8d4722fd9a" -NoExpiration For detailed syntax and parameter information, see [New-TenantAllowBlockListItem ## Use the Microsoft 365 Defender portal to create allow entries for files in the Submissions portal -You can't create allow entries for files directly in the Tenant Allow/Block List. Instead, you use the Submissions portal at <https://security.microsoft.com/reportsubmission> to report the message as a false positive. For more information about admin submissions, see [Use the Submissions portal to submit suspected spam, phish, URLs, legitimate email getting blocked, and email attachments to Microsoft](admin-submission.md). +You can't create allow entries for files directly in the Tenant Allow/Block List. Instead, you use the Submissions portal at <https://security.microsoft.com/reportsubmission> to report the message attachment as a false positive, which also adds an allow entry on the **Files** tab in the Tenant Allow/Block List. -Reporting the file as a false positive on the **Submissions** page adds an allow entry for the file in the Tenant Allow/Block List. +For instructions, see [Report good email attachments to Microsoft](admin-submission.md#report-good-email-attachments-to-microsoft). > [!IMPORTANT] > Because Microsoft manages allow entries for you, unneeded allow entries for files will be removed. This behavior protects your organization and helps prevent misconfigured allow entries. If you disagree with the verdict, you might need to open a support case to help determine why a file is still considered bad. -1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. --2. On the **Submissions** page, select the **Email attachments** tab. --3. On the **Email attachments** tab, click  **Submit to Microsoft for analysis**. --4. On the **Submit to Microsoft for analysis** flyout that appears, enter the following information: -- - **Select the submission type**: Verify the value **Email attachment** is selected. -- - **File**: Click **Browse files** to find and select the file to submit. -- - **Select a reason for submitting to Microsoft**: Select **Should not have been blocked (False positive)**, and then configure the following settings: -- - **Allow this file**: Turn on this setting . -- - **Remove allow entry after**: The default value is **30 days**, but you can select from the following values: - - **1 day** - - **7 days** - - **30 days** - - **Specific date**: The maximum value is 30 days from today. -- - **Allow entry note**: Enter optional information about why you're allowing this file. -- When you're finished, click **Submit**, and then click **Done**. -- :::image type="content" source="../../media/admin-submission-file-allow.png" alt-text="Submit a false positive (good) email attachment to Microsoft for analysis on the Submissions page in the Defender portal." lightbox="../../media/admin-submission-file-allow.png"::: --5. After a few moments, the allow entry will appear on the **Files** tab on the **Tenant Allow/Block List** page. --> [!NOTE] -> When the file is encountered again, it's not sent for [Safe Attachments](safe-attachments.md) detonation or file reputation checks, and all other file-based filters are skipped. During mail flow, if messages containing the file pass other non-file checks in the filtering stack, the messages will be delivered. - ## Use the Microsoft 365 Defender portal to view allow or block entries for files in the Tenant Allow/Block List 1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Tenant Allow/Block Lists** in the **Rules** section. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>. For detailed syntax and parameter information, see [Get-TenantAllowBlockListItem ## Use the Microsoft 365 Defender portal to modify allow or block entries for files in the Tenant Allow/Block List -When you modify an allow or block file entry in the Tenant Allow/Block list, you can only modify the expiration date and notes. +When you modify allow or block entries for files in the Tenant Allow/Block list, you can only modify the expiration date and notes. 1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>. |
| security | Allow Block Urls | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/allow-block-urls.md | You have the following options to create block entries for URLs: ### Use the Microsoft 365 Defender portal to create block entries for URLs in the Submissions portal -When you use the Submissions portal at <https://security.microsoft.com/reportsubmission> to report URLs as **Should have been blocked (False negative)**, you can select **Block this file** to add a block entry for the URL in the Tenant Allow/Block List. +When you use the Submissions portal at <https://security.microsoft.com/reportsubmission> to report URLs as **Should have been blocked (False negative)**, you can select **Block this URL** to add a block entry on the **URLs** tab in the Tenant Allow/Block List. For instructions, see [Report questionable URLs to Microsoft](admin-submission.md#report-questionable-urls-to-microsoft). In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online- New-TenantAllowBlockListItems -ListType Url -Block -Entries "Value1","Value2",..."ValueN" <-ExpirationDate <Date> | -NoExpiration> [-Notes <String>] ``` -This example adds a block URL entry for contoso.com and all subdomains (for example, contoso.com and xyz.abc.contoso.com). Because we didn't use the ExpirationDate or NoExpiration parameters, the entry expires after 30 days. +This example adds a block entry for the URL contoso.com and all subdomains (for example, contoso.com and xyz.abc.contoso.com). Because we didn't use the ExpirationDate or NoExpiration parameters, the entry expires after 30 days. ```powershell New-TenantAllowBlockListItems -ListType Url -Block -Entries ~contoso.com For detailed syntax and parameter information, see [New-TenantAllowBlockListItem ## Use the Microsoft 365 Defender portal to create allow entries for URLs in the Submissions portal -You can't create URL allow entries directly in the Tenant Allow/Block List. Instead, you use the Submissions portal at <https://security.microsoft.com/reportsubmission> to report the message as a false positive. For more information about admin submissions, see [Use the Submissions portal to submit suspected spam, phish, URLs, legitimate email getting blocked, and email attachments to Microsoft](admin-submission.md). +You can't create URL allow entries directly in the Tenant Allow/Block List. Instead, you use the Submissions portal at <https://security.microsoft.com/reportsubmission> to report the URL as a false positive, which also adds an allow entry on the **URLs** tab in the Tenant Allow/Block List. -Reporting the URL as a false positive on the **Submissions** page adds an allow entry for the URL in the Tenant Allow/Block List. +For instructions, see [Report good URLs to Microsoft](admin-submission.md#report-good-urls-to-microsoft). > [!IMPORTANT] > Because Microsoft manages allow entries for you, unneeded URL allow entries will be removed. This behavior protects your organization and helps prevent misconfigured allow entries. If you disagree with the verdict, you might need to open a support case to help determine why a URL is still considered bad. -1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. --2. On the **Submissions** page, select the **URLs** tab --3. On the **URLs** tab, click  **Submit to Microsoft for analysis**. --4. In the **Submit to Microsoft for analysis** flyout that appears, enter the following information: -- - **Select the submission type**: Verify the value **URL** is selected. -- - **URL**: Enter the full URL (for example, `https://www.fabrikam.com/marketing.html`), and then select it in the box that appears. -- - **Select a reason for submitting to Microsoft**: Select **Should not have been blocked (False positive)**, and then configure the following settings: -- - **Allow this URL**: Turn on this setting . -- - **Remove allow entry after**: The default value is **30 days**, but you can select from the following values: - - **1 day** - - **7 days** - - **30 days** - - **Specific date**: The maximum value is 30 days from today. -- - **Allow entry note**: Enter optional information about why you're allowing this URL. -- When you're finished, click **Submit**, and then click **Done**. -- :::image type="content" source="../../media/admin-submission-url-allow.png" alt-text="Submit a false positive (good) URL to Microsoft for analysis on the Submissions page in the Defender portal." lightbox="../../media/admin-submission-url-allow.png"::: --5. After a few moments, the URL allow entry will appear on the **URL** tab on the **Tenant Allow/Block List** page. --> [!NOTE] -> -> - When the URL is detected again, it's not sent for [Safe Links](safe-links.md) detonation or URL reputation checks, and all other URL-based filters are skipped. -> - During mail flow, if messages containing the URL pass other non-URL checks in the filtering stack, the messages will be delivered. - ## Use the Microsoft 365 Defender portal to view allow or block entries for URLs in the Tenant Allow/Block List 1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Tenant Allow/Block Lists** in the **Rules** section. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>. For detailed syntax and parameter information, see [Get-TenantAllowBlockListItem ## Use the Microsoft 365 Defender portal to modify allow or block entries for URLs in the Tenant Allow/Block List -When you modify an allow or block URL entry in the Tenant Allow/Block list, you can only modify the expiration date and notes. +When you modify allow or block entries for URLs in the Tenant Allow/Block list, you can only modify the expiration date and notes. 1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>. In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online- Set-TenantAllowBlockListItems -ListType Url <-Ids <Identity value> | -Entries <Value value>> [<-ExpirationDate Date | -NoExpiration>] [-Notes <String>] ``` -This example changes the expiration date of the specified block URL entry. +This example changes the expiration date of the block entry for the specified URL. ```powershell Set-TenantAllowBlockListItems -ListType Url -Entries "~contoso.com" -ExpirationDate "9/1/2022" In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online- Remove-TenantAllowBlockListItems -ListType Url <-Ids <Identity value> | -Entries <Value value>> ``` -This example removes the specified block URL entry from the Tenant Allow/Block List. +This example removes the block entry for the specified URL from the Tenant Allow/Block List. ```powershell Remove-TenantAllowBlockListItems -ListType Url -Entries "~cohovineyard.com |
| security | Safe Attachments | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/safe-attachments.md | This section describes the settings in Safe Attachments policies: |**Off**|Attachments aren't scanned for malware by Safe Attachments. Messages are still scanned for malware by [anti-malware protection in EOP](anti-malware-protection.md).|Turn scanning off for selected recipients. <br/><br/> Prevent unnecessary delays in routing internal mail. <br/><br/> **This option is not recommended for most users. You should only use this option to turn off Safe Attachments scanning for recipients who only receive messages from trusted senders. ZAP will not quarantine messages if Safe Attachments is turned off and a malware signal is not received. For details, see [Zero-hour auto purge](zero-hour-auto-purge.md)**| |**Monitor**|Delivers messages with attachments and then tracks what happens with detected malware. <br/><br/> Delivery of safe messages might be delayed due to Safe Attachments scanning.|See where detected malware goes in your organization.| |**Block**|Prevents messages with detected malware attachments from being delivered. <br/><br/> Messages are quarantined. By default, only admins (not users) can review, release, or delete the messages.<sup>\*</sup> <br/><br/> Automatically blocks future instances of the messages and attachments. <br/><br/> Delivery of safe messages might be delayed due to Safe Attachments scanning.|Protects your organization from repeated attacks using the same malware attachments. <br/><br/> This is the default value, and the recommended value in Standard and Strict [preset security policies](preset-security-policies.md).|- |**Replace**|Removes detected malware attachments. <br/><br/> Notifies recipients that attachments have been removed. <br/><br/> Messages that contain malicious attachments are quarantined. By default, only admins (not users) can review, release, or delete the messages.<sup>\*</sup> <br/><br/> Delivery of safe messages might be delayed due to Safe Attachments scanning.|Raise visibility to recipients that attachments were removed because of detected malware.| + |**Replace**|**Note**: This action will be deprecated. For more information, see [MC424901](https://admin.microsoft.com/AdminPortal/Home#/MessageCenter/:/messages/MC424901). <br/><br/> Removes detected malware attachments. <br/><br/> Notifies recipients that attachments have been removed. <br/><br/> Messages that contain malicious attachments are quarantined. By default, only admins (not users) can review, release, or delete the messages.<sup>\*</sup> <br/><br/> Delivery of safe messages might be delayed due to Safe Attachments scanning.|Raise visibility to recipients that attachments were removed because of detected malware.| |**Dynamic Delivery**|Delivers messages immediately, but replaces attachments with placeholders until Safe Attachments scanning is complete. <br/><br/> Messages that contain malicious attachments are quarantined. By default, only admins (not users) can review, release, or delete the messages.<sup>\*</sup> <br/><br/> For details, see the [Dynamic Delivery in Safe Attachments policies](#dynamic-delivery-in-safe-attachments-policies) section later in this article.|Avoid message delays while protecting recipients from malicious files.| <sup>\*</sup>**Quarantine policy**: Admins can create and assign _quarantine policies_ in Safe Attachments policies that define what users are allowed to do to quarantined messages. For more information, see [Quarantine policies](quarantine-policies.md). This section describes the settings in Safe Attachments policies: The recommendation for Standard and Strict policy settings is to enable redirection. For more information, see [Safe Attachments settings](recommended-settings-for-eop-and-office365.md#safe-attachments-settings). + > [!NOTE] + > Redirection will soon be available only for the **Monitor** action. For more information, see [MC424899](https://admin.microsoft.com/AdminPortal/Home?#/MessageCenter/:/messages/MC424899). + - **Apply the Safe Attachments detection response if scanning can't complete (timeout or errors)**: The action specified by **Safe Attachments unknown malware response** is taken on messages even when Safe Attachments scanning can't complete. Always select this option if you select **Enable redirect**. Otherwise, messages might be lost. - **Priority**: If you create multiple policies, you can specify the order that they're applied. No two policies can have the same priority, and policy processing stops after the first policy is applied. |
| security | Set Up Safe Attachments Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/set-up-safe-attachments-policies.md | Creating a custom Safe Attachments policy in the Microsoft 365 Defender portal c - **Off**: Typically, we don't recommend this value. - **Monitor** - **Block**: This is the default value, and the recommended value in Standard and Strict [preset security policies](preset-security-policies.md).- - **Replace** + - **Replace**: This action will be deprecated. For more information, see [MC424901](https://admin.microsoft.com/AdminPortal/Home#/MessageCenter/:/messages/MC424901). - **Dynamic Delivery (Preview feature)** These values are explained in [Safe Attachments policy settings](safe-attachments.md#safe-attachments-policy-settings). Creating a custom Safe Attachments policy in the Microsoft 365 Defender portal c - **Redirect messages with detected attachments**: If you select **Enable redirect**, you can specify an email address in the **Send messages that contain blocked, monitored, or replaced attachments to the specified email address** box to send messages that contain malware attachments for analysis and investigation. - The recommendation for Standard and Strict policy settings is to enable redirection. For more information, see [Safe Attachments settings](recommended-settings-for-eop-and-office365.md#safe-attachments-settings). + > [!NOTE] + > Redirection will soon be available only for the **Monitor** action. For more information, see [MC424899](https://admin.microsoft.com/AdminPortal/Home?#/MessageCenter/:/messages/MC424899). - **Apply the Safe Attachments detection response if scanning can't complete (timeout or errors)**: The action specified by **Safe Attachments unknown malware response** is taken on messages even when Safe Attachments scanning can't complete. If you selected this option, always select **Enable redirect** and specify an email address to send messages that contain malware attachments. Otherwise, messages might be lost. |
| security | Trial Playbook Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/trial-playbook-defender-for-office-365.md | Let's get started! #### Start your Microsoft Defender for Office 365 trial -After you've initiated the trial and completed the [setup process](try-microsoft-defender-for-office-365.md#set-up-an-evaluation-in-blocking-mode), it may take up to 2 hours for changes to take effect. +After you've initiated the trial and completed the [setup process](try-microsoft-defender-for-office-365.md#set-up-an-evaluation-or-trial-in-blocking-mode), it may take up to 2 hours for changes to take effect. We've automatically configured [Preset security policies](preset-security-policies.md) in your environment. These policies represent a baseline protection profile that's suitable for most users. Standard protection includes: Equip your users with the right knowledge to identify threats and report suspici #### Start your Defender for Office 365 evaluation -After you've completed the [setup process](try-microsoft-defender-for-office-365.md#set-up-an-evaluation-in-audit-mode), it may take up to 2 hours for changes to take effect. We've automatically configured Preset Evaluation policies in your environment. +After you've completed the [setup process](try-microsoft-defender-for-office-365.md#set-up-an-evaluation-or-trial-in-audit-mode), it may take up to 2 hours for changes to take effect. We've automatically configured Preset Evaluation policies in your environment. Evaluation policies ensure no action is taken on email that's detected by Defender for Office 365. Watch this video to learn more: [Learn how to use the Submissions portal to subm Use the reporting capabilities in Defender for Office 365 to get more details about your environment. -- The [Evaluation dashboard](try-microsoft-defender-for-office-365.md#reporting-in-audit-mode) provides an easy view of the threats detected by Defender for Office 365 during evaluation.+- The [Evaluation dashboard](try-microsoft-defender-for-office-365.md#reports-for-audit-mode-only) provides an easy view of the threats detected by Defender for Office 365 during evaluation. - Understand threats received in email and collaboration tools with the [Threat protection status report](view-email-security-reports.md#threat-protection-status-report). ### Step 2: Intermediate steps in auditing mode |
| security | Try Microsoft Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/try-microsoft-defender-for-office-365.md | Title: Try and evaluate Defender for Office 365 description: Learn how to evaluate and try the capabilities of Microsoft Defender for Office 365 without affecting your existing mail flow. -keywords: +keywords: Try, Evaluate, Trial, Evaluation, Defender for Office 365 f1.keywords: - NOCSH ROBOTS: # Try Microsoft Defender for Office 365 -The unified **Trials** portal in the Microsoft 365 Defender portal provides a single point of entry for the formerly separate Trial and Evaluate experiences for Microsoft Defender for Office 365. The intent is to allow you to try the features of Defender for Office 365 Plan 2 for 90 days before you fully commit to it. But, there are differences in the evaluation experiences based on the nature of your Microsoft 365 organization: +As an existing Microsoft 365 customer, the **Trials** and **Evaluation** pages in the Microsoft 365 Defender portal at <https://security.microsoft.com> allow you to try the features of Microsoft Defender for Office 365 Plan 2 before you buy. -- You already have Microsoft 365 mailboxes, but you're currently using a third-party service or device for email protection. Mail from the internet flows through the protection service before delivery into your Microsoft 365 organization. Microsoft 365 protection is as low as possible (it's never completely off; for example, malware protection is always enforced).+Before you try Defender for Office 365 Plan 2, there are some key questions that you need to ask yourself: -  +- Do I want to passively observe what Defender for Office 365 Plan 2 can do for me (*audit*), or do I want Defender for Office 365 Plan 2 to take direct action on issues that it finds (*block*)? +- Either way, how can I tell what Defender for Office 365 Plan 2 is doing for me? +- How long do I have before I need to make the decision to keep Defender for Office 365 Plan 2? - In these environments, you can only try Defender for Office 365 in *audit* mode. You don't need to change your mail flow (MX records) to try Defender for Office 365. +This article will help you answer those questions so you can try Defender for Office 365 Plan 2 in a way that best meets the needs of your organization. -- You already have a Microsoft 365 organization. Mail from the internet flows directly Microsoft 365, but your current subscription has only [Exchange Online Protection (EOP)](exchange-online-protection-overview.md) or [Defender for Office 365 Plan 1](overview.md#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet).+For a companion guide for how to use your trial, see [Trial playbook: Microsoft Defender for Office 365](trial-playbook-defender-for-office-365.md). -  +## Overview of Defender for Office 365 - In these environments, you can try Defender for Office 365 in *audit* mode or in *blocking mode*. +Defender for Office 365 helps organizations secure their enterprise by offering a comprehensive slate of capabilities. For more information, see [Microsoft Defender for Office 365](defender-for-office-365.md). ++You can also learn more about Defender for Office 365 at this [interactive guide](https://aka.ms/MS365D.InteractiveGuide). -You're invited to start your trial in various Defender for Office 365 feature locations in the Microsoft 365 Defender portal at <https://security.microsoft.com>. The centralized location to start your trial is on the **Trials** page at <https://security.microsoft.com/atpEvaluation>. + Watch this short video to learn more about how you can get more done in less time with Microsoft Defender for Office 365.-> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWMmIe] -The rest of this article explains the difference between audit mode blocking mode, how to configure evaluations, and other details. +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RWMmIe] -For a companion guide for how to use your trial, see [Trial playbook: Microsoft Defender for Office 365](trial-playbook-defender-for-office-365.md). +## How trials and evaluations work for Defender for Office 365 -## Overview of Defender for Office 365 +### Policies -Defender for Office 365 helps organizations secure their enterprise by offering a comprehensive slate of capabilities. For more information, see [Microsoft Defender for Office 365](defender-for-office-365.md). +Defender for Office 365 includes the features of Exchange Online Protection (EOP), which are present in all Microsoft 365 organizations with Exchange Online mailboxes, and features that are exclusive to Defender for Office 365. -You can also learn more about Defender for Office 365 at this [interactive guide](https://aka.ms/MS365D.InteractiveGuide). +The protection features of EOP and Defender for Office 365 are implemented using policies. **Policies that are exclusive to Defender for Office 365 are created for you as needed**: - +- [Impersonation protection in anti-phishing policies](set-up-anti-phishing-policies.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365) +- [Safe Attachments for email messages](safe-attachments.md) +- [Safe Links for email messages and Microsoft Teams](safe-links.md) + - Safe Links detonates URLs during mail flow. To prevent specific URLs from being detonated, use allow entries for URLs in the Tenant Allow/Block List. For more information, see [Manage the Tenant Allow/Block List](manage-tenant-allow-block-list.md). + - Safe Links doesn't wrap URL links in email message bodies. ++Your eligibility for an evaluation or trial means you already have EOP. **No new or special EOP policies are created for your evaluation or trial of Defender for Office 365 Plan 2**. Existing EOP policies in your Microsoft 365 organization are able to act on messages (for example, send messages to the Junk Email folder or to quarantine): ++- [Anti-malware policies](anti-malware-protection.md) +- [Inbound anti-spam protection](anti-spam-protection.md) +- [Anti-spoofing protection in anti-phishing policies](set-up-anti-phishing-policies.md#spoof-settings) ++The default policies for these EOP features are always on, apply to all recipients, and are always applied last after any custom policies. -## Policies in blocking mode or audit mode +### Audit mode vs. blocking mode for Defender for Office 365 -When you evaluate Defender for Office 365, the policies that control protection features in Microsoft 365 are present: +Do you want your Defender for Office 365 experience to be active or passive? These are the two modes that you can select from: -- **Exchange Online Protection (EOP)**: No new or special policies are created. Existing EOP policies are able to act on messages (for example, send messages to the Junk Email folder or to quarantine):+- **Audit mode**: Special *evaluation policies* are created for anti-phishing (which includes impersonation protection), Safe Attachments, and Safe Links. These evaluation policies are configured to *detect* threats only. Defender for Office 365 detects harmful messages for reporting, but the messages aren't acted upon (for example, detected messages aren't quarantined). The settings of these evaluation policies are described in the [Policies in audit mode](#policies-in-audit-mode) section later in this article. - - [Anti-malware policies](anti-malware-protection.md) - - [Inbound anti-spam protection](anti-spam-protection.md) - - [Anti-spoofing protection in anti-phishing policies](set-up-anti-phishing-policies.md#spoof-settings) + Audit mode provides access to customized reports for threats detected by Defender for Office 365 on the **Evaluation mode** page at<https://security.microsoft.com/atpEvaluation>. - The default policies for these features are always on, apply to all recipients, and are always applied last (after any custom policies). +- **Blocking mode**: The Standard template for [preset security policies](preset-security-policies.md) is turned on and used for the trial, and the users you specify to include in the trial are added to the Standard preset security policy. Defender for Office 365 *detects* and *takes action on* harmful messages (for example, detected messages are quarantined). -- **Defender for Office 365**: Policies that are exclusive to Defender for Office 365 are created for your evaluation of Defender for Office 365:+ The default and recommended selection is to scope these Defender for Office 365 policies to all users in the organization. But during or after the setup of your trial, you can change the policy assignment to specific users, groups, or email domains in the Microsoft 365 Defender portal or in [Exchange Online PowerShell](#policy-settings-associated-with-defender-for-office-365-trials). - - [Impersonation protection in anti-phishing policies](set-up-anti-phishing-policies.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365) - - [Safe Attachments for email messages](safe-attachments.md) - - [Safe Links for email messages and Microsoft Teams](safe-links.md) + Blocking mode does not provide customized reports for threats detected by Defender for Office 365. Instead, the information is available in the regular reports and investigation features of Defender for Office 365 Plan 2. - But, the nature of these policies is different in blocking mode and audit mode: +A key factor in audit mode vs. blocking mode is how email is delivered to your Microsoft 365 organization: - - **Audit mode**: Regular policies are created, but the policies are configured only to *detect* threats. Defender for Office 365 detects harmful messages for reporting, but the messages aren't acted upon (for example, detected messages aren't quarantined). +- Mail from the internet flows directly Microsoft 365, but your current subscription has only [Exchange Online Protection (EOP)](exchange-online-protection-overview.md) or [Defender for Office 365 Plan 1](overview.md#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet). - - **Blocking mode**: Policies are created using the Standard template for [preset security policies](preset-security-policies.md). Defender for Office 365 *detects* and *takes action on* harmful messages (for example, detected messages are quarantined). +  ++ In these environments, you can select **audit mode** or **blocking mode**. ++- You're currently using a third-party service or device for email protection of your Microsoft 365 mailboxes. Mail from the internet flows through the protection service before delivery into your Microsoft 365 organization. Microsoft 365 protection is as low as possible (it's never completely off; for example, malware protection is always enforced). ++  ++ In these environments, you can select **audit mode** only. You don't need to change your mail flow (MX records). ++### Evaluation vs. trial for Defender for Office 365 ++What's the difference between an evaluation and a trial of Defender for Office 365 Plan 2? Aren't they the same thing? Well, yes and no. Here's what you need to know: - The default and recommended selection is to scope these Defender for Office 365 policies to all users in the organization. But during or after setup, you can change the policy assignment to specific users, groups, or email domains. +- If you don't already have Defender for Office 365 Plan 2 licenses (for example, standalone EOP, Microsoft 365 E3, Microsoft 365 Business Premium, or Defender for Office 365 Plan 1), you can start your trial from the **Microsoft 365 trials** page at <https://security.microsoft.com/trialHorizontalHub> or the **Evaluation mode** page at <https://security.microsoft.com/atpEvaluation> in the Microsoft 365 Defender portal. At either location, you can select **allow mode** (Standard preset security policy) or **blocking mode** (evaluation policies) as previously described. -**Notes**: + Regardless of which location you use, we'll automatically provision the required Defender for Office 365 Plan 2 trial licenses for you when you enroll. Manual or outside steps for getting and assigning Plan 2 licenses in the Microsoft 365 admin center are no longer required. The trial licenses are good for 90 days: -- Safe Links will detonate URLs in mail flow. To prevent specific URLs from being detonated, use the Tenant Allow/Block List. For more information, see [Manage the Tenant Allow/Block List](manage-tenant-allow-block-list.md).-- Safe Links doesn't wrap URL links in email message bodies.-- The evaluation policy settings are described in the [Evaluation policy settings](#evaluation-policy-settings) section later in this article.+ - For organizations without Defender for Office 365 (for example, standalone EOP or Microsoft 365 E3) the features (in particular, the policies) of Defender for Office 365 are available to you during the trial period. -## Set up an evaluation in audit mode + - Organizations with Defender for Office 365 Plan 1 (for example Microsoft 365 Business Premium or add-on subscriptions) have exactly the same policies as organizations with Defender for Office 365 Plan 2 (impersonation protection in anti-phishing policies, Safe Attachments policies, and Safe Links policies). The security policies from **allow mode** (Standard preset security policy) or **blocking mode** (evaluation policies) don't expire or stop working after 90 days. What ends after 90 days for these organizations are the [automation, investigation, remediation, and education capabilities](defender-for-office-365.md#microsoft-defender-for-office-365-plan-1-and-plan-2) of Plan 2 that aren't present in Plan 1. -1. Click **Start evaluation**. +- If you already have Defender for Office 365 Plan 2 (for example, as part of a Microsoft 365 E5 subscription), you'll never see **Defender for Office 365** on the **Microsoft 365 trials** page at <https://security.microsoft.com/trialHorizontalHub>. Instead, you start your evaluation of Defender for Office 365 Plan to on the **Evaluation mode** page at <https://security.microsoft.com/atpEvaluation> in **allow mode** (Standard preset security policy) or **blocking mode** (evaluation policies). ++ By definition, these organizations don't require trial licenses of Defender for Office 365 Plan 2, so their evaluations are unlimited in duration. ++The information from the previous list is summarized in the following table: ++|Organization|Available modes|Enroll from the<br/>Evaluation page?|Enroll from the<br/>Trials page?|Evaluation<br/>period| +|||::|::|| +|Standalone EOP<br/>(no Exchange Online mailboxes) <br/><br/> Microsoft 365 E3|Audit mode <br/> Blocking mode|Yes|Yes|90 days| +|Defender for Office 365 Plan 1 <br/><br/> Microsoft 365 Business Premium|Audit mode <br/> Blocking mode|Yes|Yes|Unlimited<sup>\*</sup>| +|Microsoft 365 E5|Audit mode <br/> Blocking mode|Yes|No|Unlimited| ++<sup>\*</sup> The security policies from **allow mode** (Standard preset security policy) or **blocking mode** (evaluation policies) don't expire or stop working after 90 days. Only the [automation, investigation, remediation, and education capabilities](defender-for-office-365.md#microsoft-defender-for-office-365-plan-1-and-plan-2) that are exclusive to Defender for Office 365 Plan 2 stop working after 90 days. ++## Set up an evaluation or trial in audit mode ++Remember, when you evaluate Defender for Office 365 in audit mode, special evaluation policies are created so Defender for Office 365 can detect threats. The settings of these evaluation policies are described in the [Policies in audit mode](#policies-in-audit-mode) section later in this article. ++1. Start the evaluation in any of the available locations in the Microsoft 365 Defender portal at <https://security.microsoft.com>. For example: + - On the banner at the top of any Defender for Office 365 feature page, click **Start free trial**. + - On the **Microsoft 365 trials** page at <https://security.microsoft.com/trialHorizontalHub>, find and select **Defender for Office 365**. + - On the **Evaluation mode** page at <https://security.microsoft.com/atpEvaluation>, click **Start evaluation**. 2. In the **Turn on protection** dialog, select **No, I only want reporting**, and then click **Continue**. When you evaluate Defender for Office 365, the policies that control protection For users or groups, you can use most identifiers (name, display name, alias, email address, account name, etc.), but the corresponding display name is shown in the results. For users, enter an asterisk (\*) by itself to see all available values. > [!NOTE]- > You can change these selections after you finish setting up the evaluation. + > You can change these selections after you finish setting up the trial as described in the [Manage your trial](#manage-your-evaluation-or-trial-of-defender-for-office-365) section. + > + > Multiple different types of conditions or exceptions are not additive; they're inclusive. The evaluation or trial is applied *only* to those recipients that match *all* of the specified recipient filters. For example, you configure a condition with the following values: + > + > - **Users**: romain@contoso.com + > - **Groups**: Executives + > + > The evaluation or trial is applied to romain@contoso.com *only* if he's also a member of the Executives group. If he's not a member of the group, then the evaluation or trial is not applied to him. + > + > Likewise, if you use the same recipient filter as an exception, the evaluation or trial is not applied to romain@contoso.com *only* if he's also a member of the Executives group. If he's not a member of the group, then the evaluation or trial still applies to him. When you're finished, click **Continue**. 4. In the **Help us understand your mail flow** dialog, configure the following options: - - **Share data with Microsoft**: This option is selected by default, but you can clear the check box if you like. - - One of the following options is automatically selected based on our detection of the MX record for your domain: - **I'm using a third-party and/or on-premises service provider**: The MX record for your domain points somewhere other than Microsoft 365. This selection requires the following additional settings after you click **Next**: When you evaluate Defender for Office 365, the policies that control protection [Enhanced Filtering for Connectors](/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors) (also known as *skip listing*) is automatically configured on the connector that you specify. - When a third-party service or device sits in front of Microsoft 365, Enhanced Filtering for Connectors correctly identifies the source of internet messages and greatly improves the accuracy of the Microsoft filtering stack (especially [spoof intelligence](anti-spoofing-protection.md), as well as post-breach capabilities in [Threat Explorer](threat-explorer.md) and [Automated Investigation & Response (AIR)](automated-investigation-response-office.md)). + When a third-party service or device sits in front of email flowing into Microsoft 365, Enhanced Filtering for Connectors correctly identifies the source of internet messages and greatly improves the accuracy of the Microsoft filtering stack (especially [spoof intelligence](anti-spoofing-protection.md), as well as post-breach capabilities in [Threat Explorer](threat-explorer.md) and [Automated Investigation & Response (AIR)](automated-investigation-response-office.md). - **List each gateway IP address your messages pass through**: This setting is available only if you selected **Other** for **Select a third party service provider**. Enter a comma-separated list of the IP addresses that are used by the third-party protection service or device to send mail into Microsoft 365. When you evaluate Defender for Office 365, the policies that control protection - **I'm only using Microsoft Exchange Online**: The MX records for your domain point to Microsoft 365. There's nothing left to configure, so click **Finish**. + - **Share data with Microsoft**: This option isn't selected by default, but you can select the check box if you like. + 5. A progress dialog appears as your evaluation is set up. When set up is complete, click **Done**. -## Set up an evaluation in blocking mode +## Set up an evaluation or trial in blocking mode ++Remember, when you try Defender for Office 365 in blocking mode, the Standard preset security is turned on and the specified users (some or everyone) are included in the Standard preset security policy. For more information about the Standard preset security policy, see [Preset security policies](preset-security-policies.md). -1. Click **Start evaluation**. +1. Start the trial in any of the available locations in the Microsoft 365 Defender portal at <https://security.microsoft.com>. For example: + - On the banner at the top of any Defender for Office 365 feature page, click **Start free trial**. + - On the **Microsoft 365 trials** page at <https://security.microsoft.com/trialHorizontalHub>, find and select **Defender for Office 365**. + - On the **Evaluation mode** page at <https://security.microsoft.com/atpEvaluation>, click **Start evaluation**. 2. In the **Turn on protection** dialog, select **Yes, protect my organization by blocking threats**, and then click **Continue**. 3. In the **Select the users you want to include** dialog, configure the following settings: - **All users**: This is the default and recommended option.- - **Select users**: If you select this option, you need to select the internal recipients that the evaluation applies to: + - **Select users**: If you select this option, you need to select the internal recipients that the trial applies to: - **Users**: The specified mailboxes, mail users, or mail contacts. - **Groups**: - Members of the specified distribution groups or mail-enabled security groups. When you evaluate Defender for Office 365, the policies that control protection For users or groups, you can use most identifiers (name, display name, alias, email address, account name, etc.), but the corresponding display name is shown in the results. For users, enter an asterisk (\*) by itself to see all available values. > [!NOTE]- > You can change these selections after you finish setting up the evaluation. + > You can change these selections after you finish setting up the trial as described in the [Manage your trial](#manage-your-evaluation-or-trial-of-defender-for-office-365) section. + > + > Multiple different types of conditions or exceptions are not additive; they're inclusive. The evaluation or trial is applied *only* to those recipients that match *all* of the specified recipient filters. For example, you configure a condition with the following values: + > + > - **Users**: romain@contoso.com + > - **Groups**: Executives + > + > The evaluation or trial is applied to romain@contoso.com *only* if he's also a member of the Executives group. If he's not a member of the group, then the evaluation or trial is not applied to him. + > + > Likewise, if you use the same recipient filter as an exception, the evaluation or trial is not applied to romain@contoso.com *only* if he's also a member of the Executives group. If he's not a member of the group, then the evaluation or trial still applies to him. When you're finished, click **Continue**. 4. A progress dialog appears as your evaluation is set up. When setup is complete, click **Done**. -## Reporting in audit mode +## Manage your evaluation or trial of Defender for Office 365 ++After you set up your evaluation or trial in audit mode or blocking mode, the **Evaluation mode** page at <https://security.microsoft.com/atpEvaluation> is your central location for information about trying Defender for Office 365 Plan 2. ++1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration** \> **Policies & rules** \> **Threat policies** \> select **Evaluation mode** in the **Others** section. Or, to go directly to the **Microsoft Defender for Office 365 evaluation** page, use <https://security.microsoft.com/atpEvaluation>. ++2. On the **Microsoft Defender for Office 365 evaluation** page, you can do the following tasks: ++ - Click **Buy a paid subscription** to buy Defender for Office 365 Plan 2. ++ - Click **Manage**. In the **Microsoft Defender for Office 365 evaluation** flyout that appears, you can do the following tasks: ++ - Change who the evaluation or trial applies to as described earlier in the [Set up an evaluation or trial in audit mode](#set-up-an-evaluation-or-trial-in-audit-mode) and [Set up an evaluation or trial in blocking mode](#set-up-an-evaluation-or-trial-in-blocking-mode). ++ - To switch from **audit mode** (evaluation policies) to blocking mode (Standard preset security policy), click **Convert to standard protection**, and then click **Continue** in the dialog that appears to be taken to the **Apply standard protection** wizard on the **Preset security policies** page. The existing included and excluded recipients are copied over. For more information, see [Use the Microsoft 365 Defender portal to assign Standard and Strict preset security policies to users](preset-security-policies.md#use-the-microsoft-365-defender-portal-to-assign-standard-and-strict-preset-security-policies-to-users). ++ **Notes**: ++ - The policies in the Standard preset security policy have a higher priority than the evaluation policies, which means the policies in the Standard preset security are always applied *before* the evaluation policies, even if both are present and turned on. To turn off the evaluation policies, use the **Turn off** button. + - There's no automatic way to go from **blocking mode** to **audit mode**. The manual steps are: + 1. Turn off the Standard preset security policy on the **Preset security policies** page. + 2. After clicking **Manage** on the **Microsoft Defender for Office 365 evaluation** page, verify the presence of the **Turn off** button, which indicates the evaluation policies are turned on. If you see the **Turn on** button, click it to turn on the evaluation policies. + 3. Verify the users that the evaluation applies to. ++ - To turn off the evaluation policies, click **Turn off**. To turn them back on, click **Turn on**. ++ When you're finished in the flyout, click **Save**. ++## Reports for your evaluation or trial of Defender for Office 365 ++In **audit mode** or **blocking mode**, the following reports show detections by Defender for Office 365: ++- The [Mailflow view for the Mailflow status report](view-email-security-reports.md#mailflow-view-for-the-mailflow-status-report): ++ - Messages detected as user impersonation or domain impersonation by anti-phishing policies appear in **Impersonation block**. + - Messages detected during file or URL detonation by Safe Attachments policies or Safe Links policies appear in **Detonation block**. ++- The [Threat protection status report](view-email-security-reports.md#threat-protection-status-report): ++ - [View data by Overview](view-email-security-reports.md#view-data-by-overview): ++ You can filter most views by the **Protected by** value **MDO** to see the effects of Defender for Office 365. -- The [Threat protection status report](view-email-security-reports.md#threat-protection-status-report) shows detections by Defender for Office 365 in the following views:- - [View data by Email \> Malware and Chart breakdown by Detection Technology](view-email-security-reports.md#view-data-by-email--malware-and-chart-breakdown-by-detection-technology) - [View data by Email \> Phish and Chart breakdown by Detection Technology](view-email-security-reports.md#view-data-by-email--phish-and-chart-breakdown-by-detection-technology) -- In [Threat Explorer](threat-explorer.md), messages that were detected by the Defender for Office 365 evaluation show the following banner in the details of the entry:+ - Messages detected by [campaigns](campaigns.md) appear in **Campaign**. + - Messages detected by Safe Attachments appear in **File detonation** and **File detonation reputation**. + - Messages detected by user impersonation protection in anti-phishing policies appear in **Impersonation domain**, **Impersonation user**, and **Mailbox intelligence impersonation**. + - Messages detected by Safe Links appear in **URL detonation** and **URL detonation reputation**. -  + - [View data by Email \> Malware and Chart breakdown by Detection Technology](view-email-security-reports.md#view-data-by-email--malware-and-chart-breakdown-by-detection-technology) ++ - Messages detected by [campaigns](campaigns.md) appear in **Campaign**. + - Messages detected by Safe Attachments appear in **File detonation** and **File detonation reputation**. + - Messages detected by Safe Links appear in **URL detonation** and **URL detonation reputation**. ++ - [View data by Email \> Spam and Chart breakdown by Detection Technology](view-email-security-reports.md#view-data-by-email--spam-and-chart-breakdown-by-detection-technology) ++ Messages detected by Safe Links appear in **URL malicious reputation**. ++ - [Chart breakdown by Policy type](view-email-security-reports.md#chart-breakdown-by-policy-type) ++ Messages detected by Safe Attachments appear in **Safe Attachments** ++ - [View data by Content \> Malware](view-email-security-reports.md#view-data-by-content--malware) ++ Malicious files detected by [Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](turn-on-mdo-for-spo-odb-and-teams.md) appear in **MDO detonation**. -<! This stuff is likely not applicable for V2 reporting > + - The [Top senders and recipients report](view-email-security-reports.md#top-senders-and-recipients-report) ++ **Show data for Top malware recipients (MDO)** and **Show data for Top phish recipients (MDO)**. ++ - The [URL protection report](view-reports-for-mdo.md#url-protection-report) ++### Reports for audit mode only ++In [Threat Explorer](threat-explorer.md), messages that were detected by the Defender for Office 365 evaluation show the following banner in the details of the entry: ++  The **Microsoft Defender for Office 365 evaluation** page at <https://security.microsoft.com/atpEvaluation> consolidates the reporting for the policies in the evaluation: -- Impersonation protection in anti-phishing policies - Safe Links - Safe Attachments+- Impersonation protection in anti-phishing policies By default, the charts show data for the last 30 days, but you can filter the date range by clicking  **30 days** and selecting from following additional values that are less than 30 days: You can click  **Down ## Required permissions -Permissions that are required in **Azure AD** to set up an evaluation of Defender for Microsoft 365 are described in the following list: +The following permissions are required in **Azure AD** to set up an evaluation or trial of Defender for Microsoft 365: -- **Create, modify or delete an evaluation**: Security Administrator or Global Administrator.-- **View evaluation policies and reports**: Security Administrator or Security Reader.+- **Create, modify or delete an evaluation or trial**: Security Administrator or Global Administrator. +- **View evaluation policies and reports in audit mode**: Security Administrator or Security Reader. For more information about Azure AD permissions in the Microsoft 365 Defender portal, see [Azure AD roles in the Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md#azure-ad-roles-in-the-microsoft-365-defender-portal) -## Evaluation policy settings +## Frequently asked questions ++### Q: Do I need to manually get or activate trial licenses? ++A: No. The trial automatically provisions Defender for Office 365 Plan 2 licenses if you need them as previously described. ++### Q: How do I extend the trial? ++A: See [Extend your trial](/microsoft-365/commerce/try-or-buy-microsoft-365#extend-your-trial). ++### Q: What happens to my data after the trial expires? ++A: After your trial expires, you'll have access to your trial data (data from features in Defender for Office 365 that you didn't have previously) for 30 days. After this 30 day period, all policies and data that were associated with the Defender for Office 365 trial will be deleted. ++### Q: How many times can I use the Defender for Office 365 trial in my organization? ++A: A maximum of 2 times. If your first trial expires, you need to wait at least 30 days after the expiration date before you can enroll in the Defender for Office 365 trial again. After your second trial, you can't enroll in another trial. -The settings in the Defender for Office 365 that are specifically created for the evaluation are described in the following tables: +### Q: In audit mode, are there scenarios where Defender for Office 365 will act on messages? -**Anti-phishing evaluation policy settings**: +A: Yes. No one in any program or SKU can turn off or bypass taking action on messages that are classified as malware or high confidence phishing by the service. ++In audit mode, [anti-spoofing protection in EOP](set-up-anti-phishing-policies.md#spoof-settings) also takes action on messages. To prevent anti-spoofing protection from acting on messages, create an Exchange mail flow rule (also known as a transport rule) where inbound email bypasses all types of filtering that can be bypassed (including anti-spoofing protection). For instructions, see [Use mail flow rules to set the spam confidence level (SCL) in messages in Exchange Online](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-set-scl). ++### Q: In what order are policies evaluated? ++A: See [Order of precedence for preset security policies and other policies](preset-security-policies.md#order-of-precedence-for-preset-security-policies-and-other-policies). ++## Reference ++### Policy settings associated with Defender for Office 365 trials ++#### Policies in audit mode ++> [!WARNING] +> Do not attempt to create, modify, or remove the individual security policies that are associated with the evaluation of Defender for Office 365. The only supported method for creating the individual security policies for the evaluation is to start the evaluation or trial in audit mode in the Microsoft 365 Defender portal for the first time. ++[As previously described](#audit-mode-vs-blocking-mode-for-defender-for-office-365), when you choose audit mode for your evaluation or trial, evaluation policies with the required settings to observe but not take action on messages are automatically created. ++To see these policies and their settings, run the following command in [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell): ++```powershell +Write-Output -InputObject ("`r`n"*3),"Evaluation anti-phishing policy",("-"*79);Get-AntiPhishPolicy | Where-Object -Property RecommendedPolicyType -eq -Value "Evaluation"; Write-Output -InputObject ("`r`n"*3),"Evaluation Safe Attachments policy",("-"*79);Get-SafeAttachmentPolicy | Where-Object -Property RecommendedPolicyType -eq -Value "Evaluation"; Write-Output -InputObject ("`r`n"*3),"Evaluation Safe Links policy",("-"*79);Get-SafeLinksPolicy | Where-Object -Property RecommendedPolicyType -eq -Value "Evaluation" +``` ++The settings are also described in the following tables. ++##### Anti-phishing evaluation policy settings |Setting|Value| |||+|Name|Evaluation Policy| |AdminDisplayName|Evaluation Policy| |AuthenticationFailAction|MoveToJmf| |Enabled|True| The settings in the Defender for Office 365 that are specifically created for th |EnableUnauthenticatedSender|True| |EnableUnusualCharactersSafetyTips|False| |EnableViaTag|True|-|Guid|GUID value| +|ExcludedDomains|{}| +|ExcludedSenders|{}| |ImpersonationProtectionState|Manual| |IsDefault|False| |MailboxIntelligenceProtectionAction|NoAction| |MailboxIntelligenceProtectionActionRecipients|{}| |MailboxIntelligenceQuarantineTag|DefaultFullAccessPolicy|-|Name|Evaluation Policy| |PhishThresholdLevel|1|+|PolicyTag|blank| |RecommendedPolicyType|Evaluation| |SpoofQuarantineTag|DefaultFullAccessPolicy| |TargetedDomainActionRecipients|{}| |TargetedDomainProtectionAction|NoAction| |TargetedDomainQuarantineTag|DefaultFullAccessPolicy|+|TargetedDomainsToProtect|{}| |TargetedUserActionRecipients|{}| |TargetedUserProtectionAction|NoAction| |TargetedUserQuarantineTag|DefaultFullAccessPolicy|-||| -|AntiPhishPolicyLevelDataList|blank| -|AntiSpoofEnforcementType|High| -|AuthenticationSafetyTipText|blank| -|AuthenticationSoftPassSafetyTipText|blank| -|EnableAuthenticationSafetyTip|False| -|EnableAuthenticationSoftPassSafetyTip|False| -|PolicyTag|blank| -|SimilarUsersSafetyTipsCustomText|blank| -|TreatSoftPassAsAuthenticated|True| -|UnusualCharactersSafetyTipsCustomText|blank| -||| -|ExcludedDomains|{}| -|ExcludedSenders|{}| -|TargetedDomainsToProtect|{}| |TargetedUsersToProtect|{}| -**Safe Attachments evaluation policy settings**: +##### Safe Attachments evaluation policy settings |Setting|Value| |||+|Name|Evaluation Policy| |Action|Allow| |ActionOnError|True| |AdminDisplayName|Evaluation Policy| |ConfidenceLevelThreshold|80| |Enable|True| |EnableOrganizationBranding|False|-|Guid|GUID value| |IsBuiltInProtection|False| |IsDefault|False|-|Name|Evaluation Policy| |OperationMode|Delay| |QuarantineTag|AdminOnlyAccessPolicy| |RecommendedPolicyType|Evaluation| |Redirect|False|-|RedirectAddress|{}| +|RedirectAddress|blank| |ScanTimeout|30| -**Safe Links evaluation policy settings**: +##### Safe Links evaluation policy settings |Setting|Value| |||+|Name|Evaluation Policy| |AdminDisplayName|Evaluation Policy|-|AllowClickThrough|False| +|AllowClickThrough|True| |CustomNotificationText|blank| |DeliverMessageAfterScan|True| |DisableUrlRewrite|True| |DoNotRewriteUrls|{}| |EnableForInternalSenders|False| |EnableOrganizationBranding|False|-|EnableSafeLinksForTeams|True| -|Guid|GUID value| +|EnableSafeLinksForEmail|True| +|EnableSafeLinksForOffice|False| +|EnableSafeLinksForTeams|False| |IsBuiltInProtection|False|-|IsDefault|False| -|IsEnabled|True| |LocalizedNotificationTextList|{}|-|Name|"EvaluationPolicy"| |RecommendedPolicyType|Evaluation| |ScanUrls|True| |TrackClicks|True|-||| -|DoNotAllowClickThrough|blank| -|DoNotTrackUserClicks|False| -|EnableSafeLinksForEmail|True| -|EnableSafeLinksForOffice|True| -|ExcludedUrls|{}| -|WhiteListedUrls|blank| ++##### Use PowerShell to configure recipient conditions and exceptions to the evaluation in audit mode ++A rule that's associated with the Defender for Office 365 evaluation policies controls the recipient conditions and exceptions to the evaluation. ++To view the rule that's associated with the evaluation, run the following command in Exchange Online PowerShell: ++```powershell +Get-ATPEvaluationRule +``` ++To use Exchange Online PowerShell to modify who the evaluation applies to, use the following syntax: ++```powershell +Set-ATPEvaluationRule -Identity "Evaluation Rule" -SentTo <"user1","user2",... | $null> -ExceptIfSentTo <"user1","user2",... | $null> -SentToMemberOf <"group1","group2",... | $null> -ExceptIfSentToMemberOf <"group1","group2",... | $null> -RecipientDomainIs <"domain1","domain2",... | $null> -ExceptIfRecipientDomainIs <"domain1","domain2",... | $null> +``` ++This example configures exceptions from the evaluation for the specified security operations (SecOps) mailboxes. ++```powershell +Set-ATPEvaluationRule -Identity "Evaluation Rule" -ExceptIfSentTo "SecOps1","SecOps2" +``` ++##### Use PowerShell to turn on or turn off the evaluation in audit mode ++To turn on or turn off the evaluation in audit mode, you enable or disable the rule that's associated with the evaluation. The State property value of the evaluation rule shows whether the rule is Enabled or Disabled. ++Run the following command to determine whether the evaluation is currently enabled or disabled: ++```powershell +Get-ATPEvaluationRule -Identity "Evaluation Rule" | Format-Table Name,State +``` ++Run the following command to turn off the evaluation if it's turned on: ++```powershell +Disable-ATPEvaluationRule -Identity "Evaluation Rule" +``` ++Run the following command to turn on the evaluation if it's turned off: ++```powershell +Enable-ATPEvaluationRule -Identity "Evaluation Rule" +``` ++#### Policies and rules in block mode ++[As previously described](#audit-mode-vs-blocking-mode-for-defender-for-office-365), when you choose blocking mode for your trial, policies are created using the Standard template for [preset security policies](preset-security-policies.md). ++To use Exchange Online PowerShell to view the individual security policies that are associated with the Standard preset security policy, and to use Exchange Online PowerShell to view and configure the recipient conditions and exceptions for the preset security policy, see [Preset security policies in Exchange Online PowerShell](preset-security-policies.md#preset-security-policies-in-exchange-online-powershell). |
| whiteboard | Manage Sharing Organizations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-sharing-organizations.md | These changes should take approximately 60 minutes to apply across your tenancy. |Start the whiteboard from a desktop or mobile device|Storage: OneDrive for Business<br><br>Owner: User who creates the whiteboard|Disabled|In-tenant users: Can initiate, view, and collaborate<br><br>External users: Can't view or collaborate<br><br>Shared device accounts: Can't view or collaborate| |Start the whiteboard from a Surface Hub or Microsoft Teams Rooms|Storage: Azure (Whiteboard files will be moved to OneDrive for Business in the future)<br><br>Owner: Meeting participant|Not applicable|In-tenant users: Can initiate, view, and collaborate<br><br>External users: Can view and collaborate during the meeting only<br><br> Shared device accounts: Can view and collaborate during the meeting only| +> [!NOTE] +>If a Whiteboard is stored in OneDrive and already attached to a meeting, it cannot be initiated on a Surface Hub or Microsoft Teams Rooms device. An authenticated user on another device will need to do so. We plan to enable this functionality in a future release. +++ ## Add as a tab in Teams channels and chats When you add a whiteboard as a tab in a Teams channel or chat, Whiteboard will create a sharing link that's accessible by anyone in the organization. |