| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Add Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/add-users.md | You can use any of the following methods to add multiple users at the same time: - **Using ActiveDirectory?** [Set up directory synchronization for Microsoft 365](../../enterprise/set-up-directory-synchronization.md). Use the Azure AD Connect tool to replicate Active Directory user accounts (and other Active Directory objects) in Microsoft 365. The sync only adds the user accounts. You must assign licenses to the synced users before they can use email and other Office apps. - **Migrating from Exchange?** See [Ways to migrate multiple email accounts to Office 365](/Exchange/mailbox-migration/mailbox-migration). When you migrate multiple mailboxes to Microsoft 365 by using either cutover, staged, or a hybrid Exchange method, you automatically add users as part of the migration. The migration only adds the user accounts. You must assign licenses to the users before they can use email and other Office apps. If you don't assign a license to a user, their mailbox is disabled after a grace period of 30 days. Learn how to [assign licenses to users](../manage/assign-licenses-to-users.md) in the Microsoft 365 admin center. +## Create, edit, or delete custom user views ++If you're a global or user management admin of a Microsoft 365 for business subscription, you can create up to 50 custom user views to view subsets of users. These views are in addition to the standard set of views. You can create, edit, or delete custom user views, and the custom views you create are available to all admins. ++When you create, edit, or delete a custom user view, the changes are shown in the **Filter** list that all admins in your company see when they go to the **Users** page. ++> [!TIP] +> Standard user views are displayed by default in the **Filters** drop-down list. The standard filters include **All users**, **Licensed users**, **Guest users**, **Sign-in allowed**, **Sign-in blocked**, **Unlicensed users**, **Users with errors**, **Billing admins**, **Global admins**, **Helpdesk admins**, **Service admins**, and **User management admins**. You can't edit or delete standard views. ++A few things to note about standard views: ++- Some standard views display an unsorted list if there are more than 2,000 users in the list. To locate specific users in this list, use the search box. +- If you didn't purchase Microsoft 365 from Microsoft, **Billing admins** don't appear in the standard views list. For more information, see [Assigning admin roles](assign-admin-roles.md). + +### Choose the filters for your custom user view ++You can create and edit your custom views in the **Custom filter** pane. If you select multiple filter options, you get results that contain users who match all the selected criteria. The following example shows you how to create a custom view named "Canadian users" that shows all users on a specific domain who are in Canada. ++ **A - Domain** If you have multiple domains for your organization, you can choose from a drop-down list of domains that are available. + + **B - Sign-in status** Choose users that are allowed or blocked. + + **C - Location** Choose a location from a drop-down list of countries. + + **D - Assigned product license** Choose from a drop-down list of licenses that are available at your organization. Use this filter to show users who have the license you selected assigned to them. Users may also have additional licenses. + +You can also filter by additional user profile details used in your organization such as department, city, state or province, country or region, or job title. + + **Other conditions:** + +- **Synchronized users only** Select this box to show all users who have been synced with the local Active Directory, regardless of whether the users have been activated or not. ++- **Users with errors** Select this box to show users who may have provisioning errors. ++- **Unlicensed users** Select this box to find all the users who haven't been assigned a license. The results for this view can also include users who have an Exchange mailbox but don't have a license. To track those users specifically, use the filter **Unlicensed users with Exchange mailboxes or archives**. The results for this view can also include users who have an Exchange archive, but don't have a license. ++- **Unlicensed users with Exchange mailboxes or archives** Select this box to show user accounts that were created in Exchange Online and have an Exchange mailbox, but weren't assigned an Microsoft 365 license. The results of this filter include users who have or who were assigned an Exchange archive. ++> [!NOTE] +> The **Unlicensed users with Exchange mailboxes** filter works when: ++1. The mailbox has been recently converted from **shared** to **user** and it has no license. +2. The mailbox has been recently migrated to Microsoft 365 but a license has not been assigned. +3. The mailbox has been created using PowerShell, and a license has not been assigned. +4. A new mailbox that has been created on-premise with a New-RemoteMailbox cmdlet is provisioned for the user. ++> [!TIP] +> If you create a custom view that returns more than 2,000 users, the resulting user list isn't sorted. In this case, use the search box to find users or edit your custom view to refine your search. + +### Create a custom user view +++1. In the admin center, go to **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=834822" target="_blank">Active users</a>. + +++1. In the admin center, go to **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=850628" target="_blank">Active users</a>. ++ +2. On the **Active users** page, select **Filters** and select **New filter**. + +3. On the **Custom filter** page, enter the name for your filter, choose the conditions for your custom filter, and then select **Add**. Your custom view is now included in the drop-down list of filters. ++### Edit or delete a custom user view +++1. In the admin center, go to **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=834822" target="_blank">Active users</a>. ++++1. In the admin center, go to **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=850628" target="_blank">Active users</a>. ++ +2. On the **Active users** page, select **Filter**, select the filter you want to change, and then select **Edit filter**. + + > [!TIP] + > You can edit only custom views. + +3. On the **Custom filter** page, edit the information as needed, and then select **Save**. Or, to delete the filter, at the bottom of the page select **Delete**. + ## Next steps After you add a user, you get an email notification from Microsoft. The email contains the person's user ID and password so they can sign in to Microsoft 365. Use your normal process for communicating new passwords. Share the [Employee quickstart guide](../setup/employee-quick-setup.md) with your new users to set up things, like how to [download and install Office apps on a PC or Mac](https://support.microsoft.com/office/4414eaaf-0478-48be-9c42-23adc4716658) and how to [set up Office apps and email on a mobile device](https://support.microsoft.com/office/7dabb6cb-0046-40b6-81fe-767e0b1f014f). |
| admin | Create Edit Or Delete A Custom User View | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/create-edit-or-delete-a-custom-user-view.md | - Title: "Create, edit, or delete a custom user view"-- NOCSH-------- M365-subscription-management -- Adm_O365---- BCS160-- MET150-- MOE150 -description: "If you're a global or user management admin of a Microsoft 365 for business subscription, you can use filters to create, edit, or delete custom user view." ---# Create, edit, or delete a custom user view --If you're a global or user management admin of a Microsoft 365 for business subscription, you can create custom user views to view a specific subset of users. These views are in addition to the standard set of views. You can create, edit, or delete custom user views, and the custom views you create are available to all admins. - -## Custom user views in the admin center --When you create, edit, or delete a custom user view, the changes will be shown in the **Filter** list that all admins in your company see when they go to the **Users** page. You can create up to 50 custom views. --> [!TIP] -> Standard user views are displayed by default in the **Filters** drop-down list. The standard filters include **All users**, **Licensed users**, **Guest users**, **Sign-in allowed**, **Sign-in blocked**, **Unlicensed users**, **Users with errors**, **Billing admins**, **Global admins**, **Helpdesk admins**, **Service admins**, and **User management admins**. You can't edit or delete standard views. --A few things to note about standard views: --- Some standard views display an unsorted list if there are more than 2,000 users in the list. To locate specific users in this list, use the search box. -- If you didn't purchase Microsoft 365 from Microsoft, **Billing admins** don't appear in the standard views list. For more information, see [Assigning admin roles](assign-admin-roles.md). - -## Choose the filters for your custom user view --You can create and edit your custom views in the **Custom filter** pane. If you select multiple filter options, you get results that contain users who match all the selected criteria. The following example shows you how to create a custom view named "Canadian users" that shows all users on a specific domain who are in Canada. -- - **A - Domain** If you have multiple domains for your organization, you can choose from a drop-down list of domains that are available. - - **B - Sign-in status** Choose users that are allowed or blocked. - - **C - Location** Choose a location from a drop-down list of countries. - - **D - Assigned product license** Choose from a drop-down list of licenses that are available at your organization. Use this filter to show users who have the license you selected assigned to them. Users may also have additional licenses. - -You can also filter by additional user profile details used in your organization such as department, city, state or province, country or region, or job title. - - **Other conditions:** - -- **Synchronized users only** Select this box to show all users who have been synced with the local Active Directory, regardless of whether the users have been activated or not. - -- **Users with errors** Select this box to show users who may have provisioning errors. - -- **Unlicensed users** Select this box to find all the users who haven't been assigned a license. The results for this view can also include users who have an Exchange mailbox but don't have a license. To track those users specifically, use the filter **Unlicensed users with Exchange mailboxes or archives**. The results for this view can also include users who have an Exchange archive, but don't have a license.- -- **Unlicensed users with Exchange mailboxes or archives** Select this box to show user accounts that were created in Exchange Online and have an Exchange mailbox, but weren't assigned an Microsoft 365 license. The results of this filter include users who have or who were assigned an Exchange archive. --> [!NOTE] -> The **Unlicensed users with Exchange mailboxes** filter works when: -1. The mailbox has been recently converted from **shared** to **user** and it has no license. -2. The mailbox has been recently migrated to Microsoft 365 but a license has not been assigned. -3. The mailbox has been created using PowerShell, and a license has not been assigned. -4. A new mailbox that has been created on-premise with a New-RemoteMailbox cmdlet is provisioned for the user. - -> [!TIP] -> If you create a custom view that returns more than 2,000 users, the resulting user list isn't sorted. In this case, use the search box to find users or edit your custom view to refine your search. - -## Create a custom user view ---1. In the admin center, go to **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=834822" target="_blank">Active users</a>. - ---1. In the admin center, go to **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=850628" target="_blank">Active users</a>. -- -2. On the **Active users** page, select **Filters** and select **New filter**. - -3. On the **Custom filter** page, enter the name for your filter, choose the conditions for your custom filter, and then select **Add**. Your custom view is now included in the drop-down list of filters. --## Edit or delete a custom user view ---1. In the admin center, go to **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=834822" target="_blank">Active users</a>. ----1. In the admin center, go to **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=850628" target="_blank">Active users</a>. -- -2. On the **Active users** page, select **Filter**, select the filter you want to change, and then select **Edit filter**. - - > [!TIP] - > You can edit only custom views. - -3. On the **Custom filter** page, edit the information as needed, and then select **Save**. Or, to delete the filter, at the bottom of the page select **Delete**. --## Related content --[Overview of the Microsoft 365 admin center](../admin-overview/admin-center-overview.md) (video)\ -[About admin roles](../add-users/about-admin-roles.md) (video)\ -[Customize the Microsoft 365 theme for your organization](../setup/customize-your-organization-theme.md) (article) --- |
| admin | Resend User Password | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/resend-user-password.md | - Title: "Resend a user's password - Admin Help"-- NOCSH-------- M365-subscription-management -- Adm_O365-- Adm_TOC--- AdminSurgePortfolio-- VSBFY23-- BCS160-- MET150-- MOE150 -description: "Resend the notification email to a new user in Microsoft 365 by resetting the user's password if they didn't get the original email with their new password. " ---# Resend a Microsoft 365 user's password - Admin help --This article explains how to resend the notification email to a new user in Office 365. This can happen when you create a new user and they don't get an email with their new password. You do this by resetting the user's password. --## Before you begin --This article is for people who set password expiration policy for a business, school, or nonprofit. To complete these steps, you need to sign in with your Microsoft 365 admin account. [What's an admin account?](Overview of the Microsoft 365 admin center](../admin-overview/admin-center-overview.md). --You must be an [global admin or password administrator](about-admin-roles.md) to perform these steps. --## Resend user password - -1. In the admin center, go to the **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=834822" target="_blank">Active users</a> page. --2. On the **Active users** page, select the user and then select **Reset password**. --3. Follow the instructions on the **Reset password** page to auto-generate a new password for the user or create one for them, and then select **Reset**. --4. Enter an email address the user can get to, so they receive the new password, and follow up with them to make sure they got it. --## Related content --[Let users reset their own passwords](../add-users/let-users-reset-passwords.md) --[Reset passwords](../add-users/reset-passwords.md) |
| admin | Reset Passwords | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/reset-passwords.md | If you found this video helpful, check out the [complete training series for sma We strongly recommend that you set up self-service password reset. This way you don't have to manually reset passwords for your users. Less work for you! To learn how, see [Let users reset their own passwords in Office 365](let-users-reset-passwords.md). +## Resend user password + +1. In the admin center, go to the **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=834822" target="_blank">Active users</a> page. ++2. On the **Active users** page, select the user and then select **Reset password**. ++3. Follow the instructions on the **Reset password** page to auto-generate a new password for the user or create one for them, and then select **Reset**. ++4. Enter an email address the user can get to, so they receive the new password, and follow up with them to make sure they got it. + ## Reset my admin password Use these steps if you forgot your password but you're able to sign in to Microsoft 365 because, for example, your password is saved in your browser: For overview information, see [Manage Microsoft 365 with PowerShell](../../enter ## Force a password change for all users in your business Check out this great blog post by Vasil Michev, Microsoft MVP: [Force password change for all users in Office 365](https://go.microsoft.com/fwlink/?linkid=853693).++## Set strong passwords ++1. [Connect to Microsoft 365 with PowerShell](/office365/enterprise/powershell/connect-to-office-365-powershell#connect-with-the-microsoft-azure-active-directory-module-for-windows-powershell). ++2. Using PowerShell, you can turn off strong password requirements for all users with the following command: ++ ```powershell + Get-MsolUser | Set-MsolUser -StrongPasswordRequired $false ++3. You can turn **OFF** strong password requirements for specific users with this command: ++ ```powershell + Set-MsolUser ΓÇôUserPrincipalName ΓÇôStrongPasswordRequired $false + ``` ++> [!NOTE] +> The userPrincipalName must be in the Internet-style sign-in format where the user name is followed by the at sign (@) and a domain name. For example: user@contoso.com. ## I don't have a Microsoft 365 for business subscription |
| admin | Strong Password | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/strong-password.md | - Title: "Turn off strong password requirements for users"-- NOCSH-------- M365-subscription-management -- Adm_O365-- Adm_TOC--- MSStore_Link-- AdminSurgePortfolio-- BCS160-- MET150-- MOE150 -description: "If you're an admin who manages password policy for a business, school, or nonprofit, you can set strong password requirements by using Azure AD PowerShell." --# Turn off strong password requirements for users --This article explains how to turn off strong password requirements for your users. Strong password requirements are turned on by default in your Microsoft 365 for business organization. Your organization might have requirements to disable strong passwords. Follow the steps below to turn off strong password requirements. You have to complete these steps using PowerShell. --## Before you begin --This article is for people who manage password policy for a business, school, or nonprofit. To complete these steps, you need to sign in with your Microsoft 365 admin account. [What's an admin account?](../admin-overview/admin-center-overview.md#overview-of-the-microsoft-365-admin-center) You must be a [global admin or password administrator](about-admin-roles.md) to perform these steps. --You must also connect to Microsoft 365 with PowerShell. --## Set strong passwords --1. [Connect to Microsoft 365 with PowerShell](/office365/enterprise/powershell/connect-to-office-365-powershell#connect-with-the-microsoft-azure-active-directory-module-for-windows-powershell). --2. Using PowerShell, you can turn off strong password requirements for all users with the following command: -- ```powershell - Get-MsolUser | Set-MsolUser -StrongPasswordRequired $false --3. You can turn **OFF** strong password requirements for specific users with this command: -- ```powershell - Set-MsolUser ΓÇôUserPrincipalName ΓÇôStrongPasswordRequired $false - ``` --> [!NOTE] -> The userPrincipalName must be in the Internet-style sign-in format where the user name is followed by the at sign (@) and a domain name. For example: user@contoso.com. --## Related content --[How to connect to Microsoft 365 with PowerShell](/office365/enterprise/powershell/connect-to-office-365-powershell#connect-with-the-microsoft-azure-active-directory-module-for-windows-powershell) --[More information on PowerShell MsolUser commands](/powershell/azure/active-directory/install-adv2) --[More information on password policy](/azure/active-directory/authentication/concept-sspr-policy#password-policies-that-only-apply-to-cloud-user-accounts) |
| admin | What Is Help | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/admin-overview/what-is-help.md | - Title: "How to get help in the Microsoft 365 admin center"-- NOCSH-------- M365-subscription-management -- Adm_O365-- Adm_NonTOC--- AdminSurgePortfolio-- admindeeplinkMAC-- MET150-- MOE150-- BEA160-- GEA150- -description: "Make the most of your Microsoft 365 subscription by using the help integrated throughout Microsoft 365." --<!-- The following is just placeholder text from Madhura's mail. We need to add images/examples of each --> --# How to get help in the Microsoft 365 admin center --If you're an admin, <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">https://admin.microsoft.com</a> is your go-to place to manage and make the most of your Microsoft 365 subscription. Sometimes you might not find the right task, need more context before embarking on a task flow, or simply might not be sure of the scope and impact of your actions as an admin. To cover those situations, we provide modern help and intelligent assistance throughout the <a href="https://go.microsoft.com/fwlink/p/?linkid=2166757" target="_blank">Microsoft 365 admin center</a> in these ways: --* **Integrated help** - help in the admin center --* **Intelligent assistance** - self-help powered by AI --* **Guides and articles** - comprehensive content on the web --## Integrated help --Help is integrated throughout the <a href="https://go.microsoft.com/fwlink/p/?linkid=2166757" target="_blank">admin center</a>, so it's right there when you need it. At the top of many pages, you'll find inline help text that provides an informational overview of the task at hand, as well as links to articles that let you quickly find official documentation for more in-depth learning. -- --## Modern self-help powered by AI --To open our modern self-help experience thatΓÇÖs powered by artificial intelligence, select the **Need Help** button in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2166757" target="_blank">Microsoft 365 admin center</a>. For example, if you search for "verify my domain", you'll get the steps plus a few articles that we think will help you. We use machine learning to surface the closest solution that has helped other admins who have entered similar queries. --Or, for those times when you don't quite know how to get something done in your specific situation, use the Support Assistant. Currently, this experience is available only in English. To turn on Support Assistant, just use the toggle at the top of the **Need Help** pane. The Support Assistant provides a conversational interface to help you. After you enter your query, the chatbot asks clarifying questions to get you to the right answer for your specific situation. Think of it as your virtual helper to discover solutions and complete tasks. -- --Of course, sometimes questions are best answered by humans. If our modern self-help doesn't have the answer, you always have the option to contact our support agents. --## Guides and articles --Additionally, if you're looking for comprehensive deployment guides, quick step-by-step procedures, or PowerShell cmdlets, look us up on the web. We update content frequently and try to provide you with the latest information. Check out our articles and guides on the [Microsoft 365 Documentation](../../index.yml) site. |
| admin | Enroll Your Mobile Device | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/enroll-your-mobile-device.md | Basic Mobility and Security for Microsoft 365 hosted by the Intune service works If your device is not listed above, and you need to use it with Basic Mobility and Security, contact your work or school administrator. > [!TIP]-> If you're having trouble enrolling your device, see [Troubleshoot Basic Mobility and Security](troubleshoot.md). +> If you're having trouble enrolling your device, see [Troubleshoot Basic Mobility and Security](frequently-asked-questions.yml). ## Set up your mobile device with Intune and Basic Mobility and Security |
| admin | Get Details About Managed Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/get-details-about-managed-devices.md | - Title: "Get details about Basic Mobility and Security managed devices"-- NOCSH-------- M365-subscription-management-- Adm_O365-- Adm_TOC--- AdminSurgePortfolio-- MET150 -description: "Use Azure AD PowerShell to get details about Basic Mobility and Security devices in your organization." ---# Get details about Basic Mobility and Security managed devices --This article shows you how to use Azure AD PowerShell to get details about the devices in your organization that you set up for Basic Mobility and Security. --Here's a breakdown for the device details available to you. --|Detail|What to look for in PowerShell| -||| -|Device is enrolled in Basic Mobility and Security. For more info, see [Enroll your mobile device using Basic Mobility and Security](enroll-your-mobile-device.md)|The value of the *isManaged* parameter is:<br/>**True**= device is enrolled.<br/>**False**= device is not enrolled.| -|Device is compliant with your device security policies. For more info, see [Create device security policies](create-device-security-policies.md)|The value of the *isCompliant* parameter is:<br/>**True** = device is compliant with policies.<br/>**False** = device is not compliant with policies.| ---> [!NOTE] -> The commands and scripts in this article also return details about any devices managed by [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune). --## Before you begin --There are a few things you need to set up to run the commands and scripts described in this article. --### Step 1: Download and install the Azure Active Directory Module for Windows PowerShell --For more info on these steps, see [Connect to Microsoft 365 with PowerShell](/office365/enterprise/powershell/connect-to-office-365-powershell). --1. Go to [Microsoft Online Services Sign-In Assistant for IT Professionals RTWl](https://download.microsoft.com/download/7/1/E/71EF1D05-A42C-4A1F-8162-96494B5E615C/msoidcli_32bit.msi) and select **Download for Microsoft Online Services Sign-in Assistant**. --2. Install the Microsoft Azure Active Directory Module for Windows PowerShell with these steps: -- 1. Open an administrator-level PowerShell command prompt. -- 2. Run the `Install-Module MSOnline` command. -- 3. If prompted to install the NuGet provider, type Y and press ENTER. -- 4. If prompted to install the module from PSGallery, type Y and press ENTER. -- 5. After installation, close the PowerShell command window. --### Step 2: Connect to your Microsoft 365 subscription --1. In the Windows Azure Active Directory Module for Windows PowerShell, run the following command. -- ```powershell - $UserCredential = Get-Credential - ``` --2. In the Windows PowerShell Credential Request dialog box, type the user name and password for your Microsoft 365 global admin account, and then select **OK**. --3. Run the following command. -- ```powershell - Connect-MsolService -Credential $UserCredential - ``` --### Step 3: Make sure you're able to run PowerShell scripts --> [!NOTE] -> You can skip this step if you're already set up to run PowerShell scripts. --To run the Get-MsolUserDeviceComplianceStatus.ps1 script, you need to enable the running of PowerShell scripts. --1. From your Windows Desktop, select **Start**, and then type Windows PowerShell. Right-click Windows PowerShell, and then select **Run as administrator**. --2. Run the following command. -- ```powershell - Set-ExecutionPolicy RemoteSigned - ``` --3. When prompted, type Y and then press Enter. --#### Run the Get-MsolDevice cmdlet to display details for all devices in your organization --1. Open the Microsoft Azure Active Directory Module for Windows PowerShell. --2. Run the following command. -- ```powershell - Get-MsolDevice -All -ReturnRegisteredOwners | Where-Object {$_.RegisteredOwners.Count -gt 0} - ``` --For more examples, see [Get-MsolDevice](https://go.microsoft.com/fwlink/?linkid=2157939). --## Run a script to get device details --First, save the script to your computer. --1. Copy and paste the following text into Notepad. -- ```powershell - param ( - [PSObject[]]$users = @(), - [Switch]$export, - [String]$exportFileName = "UserDeviceComplianceStatus_" + (Get-Date -Format "yyMMdd_HHMMss") + ".csv", - [String]$exportPath = [Environment]::GetFolderPath("Desktop") - ) - [System.Collections.IDictionary]$script:schema = @{ - DeviceId = '' - DeviceOSType = '' - DeviceOSVersion = '' - DeviceTrustLevel = '' - DisplayName = '' - IsCompliant = '' - IsManaged = '' - ApproximateLastLogonTimestamp = '' - DeviceObjectId = '' - RegisteredOwnerUpn = '' - RegisteredOwnerObjectId = '' - RegisteredOwnerDisplayName = '' - } - function createResultObject - { - [PSObject]$resultObject = New-Object -TypeName PSObject -Property $script:schema - return $resultObject - } - If ($users.Count -eq 0) - { - $users = Get-MsolUser - } - [PSObject[]]$result = foreach ($u in $users) - { - [PSObject]$devices = get-msoldevice -RegisteredOwnerUpn $u.UserPrincipalName - foreach ($d in $devices) - { - [PSObject]$deviceResult = createResultObject - $deviceResult.DeviceId = $d.DeviceId - $deviceResult.DeviceOSType = $d.DeviceOSType - $deviceResult.DeviceOSVersion = $d.DeviceOSVersion - $deviceResult.DeviceTrustLevel = $d.DeviceTrustLevel - $deviceResult.DisplayName = $d.DisplayName - $deviceResult.IsCompliant = $d.GraphDeviceObject.IsCompliant - $deviceResult.IsManaged = $d.GraphDeviceObject.IsManaged - $deviceResult.DeviceObjectId = $d.ObjectId - $deviceResult.RegisteredOwnerUpn = $u.UserPrincipalName - $deviceResult.RegisteredOwnerObjectId = $u.ObjectId - $deviceResult.RegisteredOwnerDisplayName = $u.DisplayName - $deviceResult.ApproximateLastLogonTimestamp = $d.ApproximateLastLogonTimestamp - $deviceResult - } - } - If ($export) - { - $result | Export-Csv -path ($exportPath + "\" + $exportFileName) -NoTypeInformation - } - Else - { - $result - } - ``` --2. Save it as a Windows PowerShell script file by using the file extension .ps1; for example, Get-MsolUserDeviceComplianceStatus.ps1. --## Run the script to get device information for a single user account --1. Open the Microsoft Azure Active Directory Module for Windows PowerShell. --2. Go to the folder where you saved the script. For example, if you saved it to C:\PS-Scripts, run the following command. -- ```powershell - cd C:\PS-Scripts - ``` --3. Run the following command to identify the user you want to get device details for. This example gets details for bar@example.com. -- ```powershell - $u = Get-MsolUser -UserPrincipalName bar@example.com - ``` --4. Run the following command to initiate the script. -- ```powershell - .\Get-MsolUserDeviceComplianceStatus.ps1 -User $u -Export - ``` --The information is exported to your Windows Desktop as a CSV file. You can use additional parameters to specify the file name and path of the CSV. --## Run the script to get device information for a group of users --1. Open the Microsoft Azure Active Directory Module for Windows PowerShell. --2. Go to the folder where you saved the script. For example, if you saved it to C:\PS-Scripts, run the following command. -- ```powershell - cd C:\PS-Scripts - ``` --3. Run the following command to identify the group you want to get device details for. This example gets details for users in the FinanceStaff group. -- ```powershell - $u = Get-MsolGroupMember -SearchString "FinanceStaff" | % { Get-MsolUser -ObjectId $_.ObjectId } - ``` --4. Run the following command to initiate the script. -- ```powershell - .\Get-MsolUserDeviceComplianceStatus.ps1 -User $u -Export - ``` --The information is exported to your Windows Desktop as a CSV file. You can use additional parameters to specify the file name and path of the CSV. --## Related topics --[Microsoft Connect Has Been Retired](/collaborate/connect-redirect) --[Overview of Basic Mobility and Security](overview.md) --[Get-MsolDevice](https://go.microsoft.com/fwlink/?linkid=2157939) |
| admin | Manage Device Access Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/manage-device-access-settings.md | -description: "For devices that you can't manage with Basic Mobility and Security, you should block Exchange ActiveSync app access to Microsoft 365 email." +description: "For devices you can't manage with Basic Mobility and Security, block Exchange ActiveSync app access to email and use Azure AD PowerShell to get details about org devices." # Manage device access settings in Basic Mobility and Security Use these steps: 5. Select **Save**. To learn what devices Basic Mobility and Security supports, see [Capabilities of Basic Mobility and Security](capabilities.md).++## Get details about Basic Mobility and Security managed devices ++Additionally, you can use Azure AD PowerShell to get details about the devices in your organization that you set up for Basic Mobility and Security. ++Here's a breakdown for the device details available to you. ++|Detail|What to look for in PowerShell| +||| +|Device is enrolled in Basic Mobility and Security. For more info, see [Enroll your mobile device using Basic Mobility and Security](enroll-your-mobile-device.md)|The value of the *isManaged* parameter is:<br/>**True**= device is enrolled.<br/>**False**= device is not enrolled.| +|Device is compliant with your device security policies. For more info, see [Create device security policies](create-device-security-policies.md)|The value of the *isCompliant* parameter is:<br/>**True** = device is compliant with policies.<br/>**False** = device is not compliant with policies.| +++> [!NOTE] +> The commands and scripts that follow also return details about any devices managed by [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune). ++Here are a few things you need to set up to run the commands and scripts that follow: ++### Step 1: Download and install the Azure Active Directory Module for Windows PowerShell ++For more info on these steps, see [Connect to Microsoft 365 with PowerShell](/office365/enterprise/powershell/connect-to-office-365-powershell). ++1. Go to [Microsoft Online Services Sign-In Assistant for IT Professionals RTWl](https://download.microsoft.com/download/7/1/E/71EF1D05-A42C-4A1F-8162-96494B5E615C/msoidcli_32bit.msi) and select **Download for Microsoft Online Services Sign-in Assistant**. ++2. Install the Microsoft Azure Active Directory Module for Windows PowerShell with these steps: ++ 1. Open an administrator-level PowerShell command prompt. ++ 2. Run the `Install-Module MSOnline` command. ++ 3. If prompted to install the NuGet provider, type Y and press ENTER. ++ 4. If prompted to install the module from PSGallery, type Y and press ENTER. ++ 5. After installation, close the PowerShell command window. ++### Step 2: Connect to your Microsoft 365 subscription ++1. In the Windows Azure Active Directory Module for Windows PowerShell, run the following command. ++ ```powershell + $UserCredential = Get-Credential + ``` ++2. In the Windows PowerShell Credential Request dialog box, type the user name and password for your Microsoft 365 global admin account, and then select **OK**. ++3. Run the following command. ++ ```powershell + Connect-MsolService -Credential $UserCredential + ``` ++### Step 3: Make sure you're able to run PowerShell scripts ++> [!NOTE] +> You can skip this step if you're already set up to run PowerShell scripts. ++To run the Get-MsolUserDeviceComplianceStatus.ps1 script, you need to enable the running of PowerShell scripts. ++1. From your Windows Desktop, select **Start**, and then type Windows PowerShell. Right-click Windows PowerShell, and then select **Run as administrator**. ++2. Run the following command. ++ ```powershell + Set-ExecutionPolicy RemoteSigned + ``` ++3. When prompted, type Y and then press Enter. ++#### Run the Get-MsolDevice cmdlet to display details for all devices in your organization ++1. Open the Microsoft Azure Active Directory Module for Windows PowerShell. ++2. Run the following command. ++ ```powershell + Get-MsolDevice -All -ReturnRegisteredOwners | Where-Object {$_.RegisteredOwners.Count -gt 0} + ``` ++For more examples, see [Get-MsolDevice](https://go.microsoft.com/fwlink/?linkid=2157939). ++### Run a script to get device details ++First, save the script to your computer. ++1. Copy and paste the following text into Notepad. ++ ```powershell + param ( + [PSObject[]]$users = @(), + [Switch]$export, + [String]$exportFileName = "UserDeviceComplianceStatus_" + (Get-Date -Format "yyMMdd_HHMMss") + ".csv", + [String]$exportPath = [Environment]::GetFolderPath("Desktop") + ) + [System.Collections.IDictionary]$script:schema = @{ + DeviceId = '' + DeviceOSType = '' + DeviceOSVersion = '' + DeviceTrustLevel = '' + DisplayName = '' + IsCompliant = '' + IsManaged = '' + ApproximateLastLogonTimestamp = '' + DeviceObjectId = '' + RegisteredOwnerUpn = '' + RegisteredOwnerObjectId = '' + RegisteredOwnerDisplayName = '' + } + function createResultObject + { + [PSObject]$resultObject = New-Object -TypeName PSObject -Property $script:schema + return $resultObject + } + If ($users.Count -eq 0) + { + $users = Get-MsolUser + } + [PSObject[]]$result = foreach ($u in $users) + { + [PSObject]$devices = get-msoldevice -RegisteredOwnerUpn $u.UserPrincipalName + foreach ($d in $devices) + { + [PSObject]$deviceResult = createResultObject + $deviceResult.DeviceId = $d.DeviceId + $deviceResult.DeviceOSType = $d.DeviceOSType + $deviceResult.DeviceOSVersion = $d.DeviceOSVersion + $deviceResult.DeviceTrustLevel = $d.DeviceTrustLevel + $deviceResult.DisplayName = $d.DisplayName + $deviceResult.IsCompliant = $d.GraphDeviceObject.IsCompliant + $deviceResult.IsManaged = $d.GraphDeviceObject.IsManaged + $deviceResult.DeviceObjectId = $d.ObjectId + $deviceResult.RegisteredOwnerUpn = $u.UserPrincipalName + $deviceResult.RegisteredOwnerObjectId = $u.ObjectId + $deviceResult.RegisteredOwnerDisplayName = $u.DisplayName + $deviceResult.ApproximateLastLogonTimestamp = $d.ApproximateLastLogonTimestamp + $deviceResult + } + } + If ($export) + { + $result | Export-Csv -path ($exportPath + "\" + $exportFileName) -NoTypeInformation + } + Else + { + $result + } + ``` ++2. Save it as a Windows PowerShell script file by using the file extension .ps1; for example, Get-MsolUserDeviceComplianceStatus.ps1. ++### Run the script to get device information for a single user account ++1. Open the Microsoft Azure Active Directory Module for Windows PowerShell. ++2. Go to the folder where you saved the script. For example, if you saved it to C:\PS-Scripts, run the following command. ++ ```powershell + cd C:\PS-Scripts + ``` ++3. Run the following command to identify the user you want to get device details for. This example gets details for bar@example.com. ++ ```powershell + $u = Get-MsolUser -UserPrincipalName bar@example.com + ``` ++4. Run the following command to initiate the script. ++ ```powershell + .\Get-MsolUserDeviceComplianceStatus.ps1 -User $u -Export + ``` ++The information is exported to your Windows Desktop as a CSV file. You can use additional parameters to specify the file name and path of the CSV. ++### Run the script to get device information for a group of users ++1. Open the Microsoft Azure Active Directory Module for Windows PowerShell. ++2. Go to the folder where you saved the script. For example, if you saved it to C:\PS-Scripts, run the following command. ++ ```powershell + cd C:\PS-Scripts + ``` ++3. Run the following command to identify the group you want to get device details for. This example gets details for users in the FinanceStaff group. ++ ```powershell + $u = Get-MsolGroupMember -SearchString "FinanceStaff" | % { Get-MsolUser -ObjectId $_.ObjectId } + ``` ++4. Run the following command to initiate the script. ++ ```powershell + .\Get-MsolUserDeviceComplianceStatus.ps1 -User $u -Export + ``` ++The information is exported to your Windows Desktop as a CSV file. You can use additional parameters to specify the file name and path of the CSV. ++## Related content ++[Microsoft Connect Has Been Retired](/collaborate/connect-redirect) ++[Overview of Basic Mobility and Security](overview.md) ++[Get-MsolDevice](https://go.microsoft.com/fwlink/?linkid=2157939) |
| admin | Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/overview.md | If you just need mobile app management (MAM), perhaps for people updating work p [Set up Basic Mobility and Security](set-up.md) (article)\ [Enroll your mobile device using Basic Mobility and Security](enroll-your-mobile-device.md) (article)\ [Manage devices enrolled in Mobile Device Management for Microsoft 365](manage-enrolled-devices.md) (article)\-[Get details about devices managed by Basic Mobility and Security](get-details-about-managed-devices.md) (article) |
| admin | Troubleshoot | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/troubleshoot.md | - Title: "Troubleshoot Basic Mobility and Security" -------- M365-subscription-management-- Adm_O365-- Adm_TOC- -description: "Try these steps to track down Basic Mobility and Security problems" ---# Troubleshoot Basic Mobility and Security --If you're running into issues when you try to enroll a device in Basic Mobility and Security, try the steps here to track down the problem. If the general steps don't fix the issue, see one of the later sections with specific steps for your device type. --## Steps to try first --To start, check the following: --- Make sure that the device isn't already enrolled with another mobile device management provider, such as Intune.--- Make sure that the device is set to the correct date and time.--- Switch to a different WIFI or cellular network on the device.--- For Android or iOS devices, uninstall and reinstall the Intune Company Portal app on the device. --## iOS phone or tablet --- Make sure that you've set up an APNs certificate. For more info, see [Create an APNs Certificate for iOS devices](create-an-apns-certificate-for-ios-devices.md).--- In **Settings** > **General** > **Profile (or Device Management)**, make sure that a Management Profile is not already installed. If it is, remove it.--- If you see the error message, "Device failed to enroll," sign in to Microsoft 365 and make sure that a license that includes Exchange Online has been assigned to the user who is signed in to the device.--- If you see the error message, "Profile failed to install," try one of the following:-- - Make sure that Safari is the default browser on the device, and that cookies aren't disabled. -- - Reboot the device, and then navigate to portal.manage.microsoft.com. Sign in with your Microsoft 365 user ID and password, and attempt to install the profile manually. --## Windows RT --- Make sure that your domain is set up in Microsoft 365 to work with Basic Mobility and Security. For more info, see [Set up Basic Mobility and Security](set-up.md).- -- Make sure that the user is choosing **Turn On** rather than choosing **Join**.--## Windows 10 PC --- Make sure that your domain is set up in Microsoft 365 to work with Basic Mobility and Security. For more info, see [Set up Basic Mobility and Security](set-up.md).- -- Unless you have Azure Active Directory Premium, make sure that the user is choosing **Enroll in Device Management only** rather than choosing **Connect**.--## Android phone or tablet --- Make sure the device is running Android.--- Make sure that Chrome is up to date and is set as the default browser.--- If you see the error message, "We couldn't enroll this device," sign in to Microsoft 365 and make sure that a license that includes Exchange Online has been assigned to the user who is signed in to the device.--- Check the Notification Area on the device to see if any required end-user actions are pending, and if they are, complete the actions. |
| admin | Empower Your Small Business With Remote Work | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/misc/empower-your-small-business-with-remote-work.md | - Title: "Empower your small business with remote work"-- NOCSH-------- Adm_O365--- AdminSurgePortfolio-- adminvideo -description: "Find the latest how-to information, tips, resources, and guidance on remote work for businesses using Microsoft 365." ---# Empower your small business with remote work --As businesses adapt to the increased need to have people work remotely and connect with their customers virtually, this site is updated with the latest how-to information, tips, resources, and guidance on remote work for businesses using Microsoft 365. --> [!TIP] -> Don't have Microsoft_Teams? Get 6 months of Microsoft Teams in Office for free (when you sign up for 1 year). Get the technologies described in this article as part of the offer. For details, see [Try 1 month free](https://aka.ms/SMBTeamsOffer). --## Remote work for your small business (video) --> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4tf7i?autoplay=false] --## Transitioning to a remote workforce --In light of the COVID-19 (Novel Coronavirus) outbreak, many business owners are finding themselves with a completely remote work staff. Here's what you can do to make a transition to remote work safe, secure, and productive. --For more information, see [Get started with Microsoft Teams in your small business](https://support.microsoft.com/office/6723dc43-dbc0-46e6-af49-8a2d1c5cb937). --Already have a subscription but need to get set up? See [Microsoft 365 small business training](../../business-video/index.yml). --## Connect with employees and customers --You can still connect with employees, customers, clients, and partners, even if you canΓÇÖt meet face to face. Use Microsoft Teams to continue doing business and connecting with your customers. --### Meet up in Teams --Host audio, video, and web meetings with employees, customers, or partners through Microsoft Teams. --For more information, see [Host online meetings](https://support.microsoft.com/office/65748808-a403-462c-a6e1-b169e5bc6c92) and [Chat with employees and customers](https://support.microsoft.com/office/65748808-a403-462c-a6e1-b169e5bc6c92). --### Store and share files --Put your business documents in the cloud and share them securely, both internally and externally. --For more information, see this [Overview of sharing business files](../../business-video/overview-file-sharing.md) and [Upload and share files](https://support.microsoft.com/office/upload-and-share-files-57b669db-678e-424e-b0a0-15d19215cb12). --### Collaborate with customers --Invite employees and customers to a team so you can work directly with them to coordinate and collaborate all in one place. --For more information, see [Create a team](https://support.microsoft.com/office/fccb4fa6-f864-4508-bdde-256e7384a14f) and [Enable guest access](/MicrosoftTeams/guest-access). --## Manage and secure your business to run remotely --Just a few steps can help you keep your business secure, even with remote employees and guest users. --### Secure your users --Use multi-factor authentication to protect your data and devices. --For more information, see [Turn on multi-factor authentication](../security-and-compliance/set-up-multi-factor-authentication.md). --### Secure your devices --Remotely manage PCs and phones and ensure that they are protected and up-to-date. Requires Microsoft 365 Business. --For more information, see [Manage devices](../../business-video/secure-win-10-pro-devices.md). --### More for admins and partners --Technical documentation hub for Microsoft 365 Business is updated with new secure remote work guidance. --For details, see [Microsoft 365 Business resources](/microsoft-365/business). --## Need to ask a question? --Ask in the [Teams forum](https://answers.microsoft.com/msteams/forum) or the [Office Admins forum](https://answers.microsoft.com). --> [!NOTE] -> Most of the tasks in this article and video can be accomplished with a subscription to Microsoft 365 Business Basic (formerly Office 365 Business Essentials), but some require a premium subscription. |
| bookings | Bookings In Outlook | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/bookings-in-outlook.md | description: "Use Bookings with me to let others schedule meetings with you in O Bookings with me has two different views: -- **Organizer view** A personal booking page where you can create meeting types that others can book with you. Custom meeting types give you the ability to customize when you want to meet and how that meeting type is shared with others. You control whether each meeting type is public to your scheduling page or is private and can only be accessed by a select group of people. You can also choose to add a Teams meeting to all meetings booked through your Bookings with me page. You can access your Bookings with me page through Outlook on the web. After you set up your page and publish it, you can share it with others. For example, you can add it to your Outlook signature.+- [Bookings with me: setup and sharing](https://support.microsoft.com/office/bookings-with-me-setup-and-sharing-ad2e28c4-4abd-45c7-9439-27a789d254a2) A personal booking page where you can create meeting types that others can book with you. Custom meeting types give you the ability to customize when you want to meet and how that meeting type is shared with others. You control whether each meeting type is public to your scheduling page or is private and can only be accessed by a select group of people. You can also choose to add a Teams meeting to all meetings booked through your Bookings with me page. You can access your Bookings with me page through Outlook on the web. After you set up your page and publish it, you can share it with others. For example, you can add it to your Outlook signature. -- **Attendee view** When you share your Bookings with me page with others, they will see the attendee view. If the organizer has shared their Bookings with me page link with you, you'll be able to see all of their public meeting types. If the organizer has shared a meeting link, you'll only be able to view that meeting.+- [Attendee view](https://support.microsoft.com/office/select-a-meeting-time-in-bookings-with-me-8f3bbe5b-4bc6-4073-bf61-57383c00b43a) When you share your Bookings with me page with others, they will see the attendee view. If the organizer has shared their Bookings with me page link with you, you'll be able to see all of their public meeting types. If the organizer has shared a meeting link, you'll only be able to view that meeting. - Public meetings can be viewed and scheduled by anyone that has your Bookings with me page link. You are in control of who you share that link with. All public meeting types will be visible to anyone that has your Bookings with me page link. - Private meetings can only be viewed by people who have the link for that meeting type. The difference between public meetings and private meetings is private meetings can have different links and the links expire after 90 days. You can also set private links to expire after a one-time booking. When accessing the scheduling view for a private meeting, only that meeting type will be visible. Bookings with me is in preview for all enterprise users worldwide. We're collect ### Who can access my public Bookings page? -Public meeting types can be accessed by anyone that has your Bookings with me page address. You decide who you share your Bookings with me page address with. +Public meeting types can be accessed by anyone that has your Bookings with me page address. You decide who you share your Bookings with me page address with. For more information, see [Select a meeting time in Bookings with me](https://support.microsoft.com/office/select-a-meeting-time-in-bookings-with-me-8f3bbe5b-4bc6-4073-bf61-57383c00b43a). ### What is the difference between public and private meeting types? Meeting types can be public or private. Public meeting types are available to anyone that you share your Bookings page link with. Private meeting types are only available to people that you share the individual private meeting type with. -Private meeting types can also generate single use links. Single use links expire after their first booking. +Private meeting types can also generate single use links. Single use links expire after their first booking. For more information, see [setup Bookings with me meeting types](https://support.microsoft.com/office/bookings-with-me-setup-and-sharing-ad2e28c4-4abd-45c7-9439-27a789d254a2). ### Do people need to have a Microsoft account or Bookings license to schedule time with me? |
| commerce | Allowselfservicepurchase Powershell | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/allowselfservicepurchase-powershell.md | Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $pr Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $product[1].ProductID -Enabled $false ``` - ## Troubleshooting ### Problem This may be due to an older version of Transport Layer Security (TLS). To connec ### Solution -Upgrade to TLS 1.2. The following syntax updates the ServicePointManager Security Protocol to TLS1.2: +Upgrade to TLS 1.2. The following syntax updates the ServicePointManager Security Protocol to allow TLS1.2: ```powershell- [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 + [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12 ``` To learn more, see [How to enable TLS 1.2](/mem/configmgr/core/plan-design/security/enable-tls-1-2). |
| compliance | Insider Risk Management Activities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-activities.md | This tab opens the summary of risk factors for the user's alert activity. Risk f - **Priority content**: Displays activities associated with priority content. - **Unallowed domains**: Displays activities for events associated with unallowed domains. - **Health record access**: Displays activities for events associated with accessing health records.+- **Risky browser usage**: Displays activities for events associated with browsing to potentially inappropriate websites. With these filters, you'll only see alerts with these risk factors, but the activity that generated an alert might not fall into any of these categories. For example, an alert containing sequence activities might have been generated simply because the user copied a file to a USB device. Use the Activity scope and Risk insight filters to display and sort activities a - Sequence activities - Cumulative exfiltration activities - Health record access activities+ - Risky browser usage  Modern workplace users often have a wide variety of responsibilities and demands - **Focus analyst and investigator efforts on the highest risk alerts first**. Depending on your policies, you may be capturing activities and generating alerts with varying degrees of potential impact to your risk mitigation efforts. [Filter alerts](insider-risk-management-activities.md#filter-alerts-on-the-alert-dashboard) by severity and prioritize *High severity* alerts. - **Assign users as analysts and investigators**. Having the right user assigned to the proper roles is an important part of the insider risk alert review process. Make sure you've assigned the appropriate users to the *Insider Risk Management Analysts* and *Insider Risk Management Investigators* role groups. -- **Use automated insider risk features to help discover the highest risk activities**. Insider risk management [sequence detection](insider-risk-management-policies.md#sequence-detection) and [cumulative exfiltration detection](insider-risk-management-policies.md#cumulative-exfiltration-detection-preview) features can help you quickly discover harder to find risks in your organization. Consider fine-tuning your [risk score boosters](insider-risk-management-settings.md#indicators), [file type exclusions](insider-risk-management-settings.md#file-type-exclusions), [domains](insider-risk-management-settings.md#domains), and the minimum [indicator threshold settings](insider-risk-management-settings.md#indicator-level-settings-preview) for your policies.+- **Use automated insider risk features to help discover the highest risk activities**. Insider risk management [sequence detection](insider-risk-management-policies.md#sequence-detection-preview) and [cumulative exfiltration detection](insider-risk-management-policies.md#cumulative-exfiltration-detection-preview) features can help you quickly discover harder to find risks in your organization. Consider fine-tuning your [risk score boosters](insider-risk-management-settings.md#indicators), [file type exclusions](insider-risk-management-settings.md#file-type-exclusions), [domains](insider-risk-management-settings.md#domains), and the minimum [indicator threshold settings](insider-risk-management-settings.md#indicator-level-settings-preview) for your policies. |
| compliance | Insider Risk Management Browser Support | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-browser-support.md | Web browsers are often used by users to access both sensitive and non-sensitive - Files printed to local or network devices - Files transferred or copied to a network share - Files copied to USB devices+- Browsing risky websites Signals for these events are detected in Microsoft Edge using built-in browser capabilities and using the *Microsoft Compliance Extension* add-on. In Google Chrome, customers use the *Microsoft Compliance Extension* for signal detection. The following table summarizes detected activities and extension support for eac | Files printed to local or network devices | Native | Extension | | Files transferred or copied to a network share | Extension | Extension | | Files copied to USB devices | Extension | Extension |+| Browsing risky websites | Extension | Extension | ## Common requirements Before installing the Microsoft Edge add-on or Google Chrome extension, customer For specific browser configuration requirements, see the Microsoft Edge and Google Chrome sections later in this article. +## Additional requirements ++If you're using policies based on the *Risky browser usage* template, at least one *Browsing indicator* must be selected in **Insider risk management** > **Settings** > **Policy indicators**. + ## Configure browser signal detection for Microsoft Edge ### Microsoft Edge browser requirements - Meet the common requirements-- Microsoft Edge x64, 91.0.864.41 version or higher-- *Microsoft Compliance Extension* add-on version 1.0.0.44 or higher+- Latest Microsoft Edge x64, version (91.0.864.41 or higher) +- Latest *Microsoft Compliance Extension* add-on (1.0.0.44 or higher) - Edge.exe is not configured as an unallowed browser ### Option 1: Basic setup (recommended for testing with Edge) -Use this option to configure single machine selfhost for each device in your organization when testing browser signal detection. +Use this option to configure a single machine selfhost for each device in your organization when testing browser signal detection. For the basic setup option, complete the following steps: Devices must be manageable using Group Policies and all [Microsoft Edge Administ Complete the following steps to add the extension: 1. In the **Group Policy Management Editor**, navigate to your Organizational Unit (OU).-2. Expand the following path **Computer/User configuration** \> **Policies** \> **Administrative templates** \> **Classic administrative templates** \> **Microsoft Edge** \> **Extensions**. This path may vary depending on the configuration for your organization. +2. Expand the following path **Computer/User configuration** \> **Policies** \> **Administrative templates** \> **Classic administrative templates** \> **Microsoft Edge** \> **Extensions**. This path may vary depending on the configuration of your organization. 3. Select **Configure which extensions are installed silently.** 4. Right-click and select **Edit**. 5. Check the **Enabled** radio button. Insider risk management browser signal detection support for Google Chrome is en - Meet common requirements - Latest version of Google Chrome x64-- *Microsoft Compliance Extension* version 2.0.0.183 or higher+- Latest *Microsoft Compliance Extension* version (2.0.0.183 or higher) - Chrome.exe is not configured as an unallowed browser ### Option 1: Basic setup (recommended for testing with Chrome) |
| compliance | Insider Risk Management Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-configure.md | Before configuring a policy, define the following insider risk settings: - [File type exclusions](insider-risk-management-settings.md#file-type-exclusions) - [Minimum number of daily events to boost score for unusual activity](insider-risk-management-settings.md#minimum-number-of-daily-events-to-boost-score-for-unusual-activity) - [Alert volume level](insider-risk-management-settings.md#alert-volume)- - [Microsoft Defender for Endpoint alert status](insider-risk-management-settings.md#microsoft-defender-for-endpoint-preview) + - [Microsoft Defender for Endpoint alert status](insider-risk-management-settings.md#microsoft-defender-for-endpoint-alert-statuses-preview) - [Domain settings](insider-risk-management-settings.md#domains) 6. On the **Export alerts** page, enable export of insider risk alert information using the Office 365 Management APIs if needed. 7. On the **Priority user groups** page, create a priority user group and add users if not created in **Step 3**. Insider risk management policies include assigned users and define which types o If you've selected at least one *Office* or *Device* indicator, select the **Risk score boosters** as appropriate. Risk score boosters are only applicable for selected indicators. If you've selected a *Data theft* or *Data leaks* policy template, select one or more **Sequence detection** methods and a **Cumulative exfiltration detection** method to apply to the policy.+ If you've selected the *Risky browser usage* policy template, select one or more of the **Browsing indicators**. 20. Select **Next** to continue. 21. On the **Decide whether to use default or custom indicator thresholds** page, choose custom or default thresholds for the policy indicators that you've selected. Choose either the **Use default thresholds for all indicators** or **Specify custom thresholds** for the selected policy indicators. If you've selected Specify custom thresholds, choose the appropriate level to generate the desired level of activity alerts for each policy indicator. |
| compliance | Insider Risk Management Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-policies.md | -Insider risk management policies determine which users are in-scope and which types of risk indicators are configured for alerts. You can quickly create a policy that applies to all users in your organization or define individual users or groups for management in a policy. Policies support content priorities to focus policy conditions on multiple or specific Microsoft Teams, SharePoint sites, data sensitivity types, and data labels. Using templates, you can select specific risk indicators and customize event thresholds for policy indicators, effectively customizing risk scores, and level and frequency of alerts. Additionally, risk score boosters and anomaly detections help identify user activity that is of higher importance or more unusual. Policy windows allow you to define the time frame to apply the policy to alert activities and are used to determine the duration of the policy once activated. +>[!IMPORTANT] +>Microsoft Purview Insider Risk Management correlates various signals to identify potentially malicious or inadvertent insider risks, such as IP theft, data leakage and security violations. Insider Risk Management enables customers to create policies to manage security and compliance. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy. ++Insider risk management policies determine which users are in-scope and which types of risk indicators are configured for alerts. You can quickly create a security policy that applies to all users in your organization or define individual users or groups for management in a policy. Policies support content priorities to focus policy conditions on multiple or specific Microsoft Teams, SharePoint sites, data sensitivity types, and data labels. Using templates, you can select specific risk indicators and customize event thresholds for policy indicators, effectively customizing risk scores, and level and frequency of alerts. Using quick policies, you can even create data leaks or data theft by departing user policies that automatically define policy conditions based on results from the latest analytics scans. Additionally, risk score boosters and anomaly detections help identify risky user activity that is of higher importance or more unusual. Policy windows allow you to define the time frame to apply the policy to alert activities and are used to determine the duration of the policy once activated. Check out the [Insider Risk Management Policies Configuration video](https://www.youtube.com/watch?v=kudK5ajZTUo) for an overview of how policies created with built-in policy templates can help you to quickly act on potential risks. ## Policy dashboard -The **Policy dashboard** allows you to quickly see the policies in your organization, the health of the policy, manually add users to policies, and to view the status of alerts associated with each policy. +The **Policy dashboard** allows you to quickly see the policies in your organization, the health of the policy, manually add users to security policies, and to view the status of alerts associated with each policy. - **Policy name**: The name assigned to the policy in the policy wizard. - **Status**: The health status for each policy. Displays number of policy warnings and recommendations, or a status of *Healthy* for policies without issues. You can select the policy to see the health status details for any warnings or recommendations. The **Policy dashboard** allows you to quickly see the policies in your organiza ## Policy recommendations from analytics -Insider risk analytics enables you to conduct an evaluation of potential insider risks in your organization without configuring any insider risk policies. This evaluation can help your organization identify potential areas of higher user risk and help determine the type and scope of insider risk management policies you may consider configuring. +Insider risk analytics gives you an aggregate view of anonymized user activities related to security and compliance, enabling you to evaluate potential insider risks in your organization without configuring any insider risk policies. This evaluation can help your organization identify potential areas of higher risk and help determine the type and scope of insider risk management policies you may consider configuring. If you decide to act on analytics scan results for general data leaks or data theft by departing users policies, you even have the option to configure a quick policy based on these results. To learn more about insider risk analytics and policy recommendations, see [Insider risk management settings: Analytics](insider-risk-management-settings.md#analytics). +## Quick policies from recommended actions (preview) ++For some organizations, getting started with an initial policy can be a challenge. If you're new to insider risk management and using the Recommended actions to get started, you can use a quick policy to expedite the configuration of a *General data leaks* or *Data theft by departing users* policy. Quick policy settings are automatically populated based on results from the latest analytics scan in your organization. For example, if the scan detected potential data leak activities, the quick policy would include the indicators used to detect those activities. You'll just need to review the quick policy settings and configure the policy with a single selection. If you need to customize a quick policy, you can change the conditions during the initial configuration or after the policy has been created. Additionally, you can stay up to date with the detection results for a quick policy by configuring email notifications each time you have a policy warning or each time the policy generates a high severity alert. + ## Policy templates Insider risk management templates are pre-defined policy conditions that define the types of risk indicators and risk scoring model used by the policy. Each policy must have a template assigned in the policy creation wizard before the policy is created. Insider risk management supports up to five policies for each policy template. When you create a new insider risk policy with the policy wizard, you'll choose from one of the following policy templates: ### Data theft by departing users -When users leave your organization, there are specific risk indicators typically associated with data theft by departing users. This policy template uses exfiltration indicators for risk scoring and focuses on detection and alerts in this risk area. Data theft for departing users may include downloading files from SharePoint Online, printing files, and copying data to personal cloud messaging and storage services near their employment resignation and end dates. By using either the Microsoft 365 HR connector or the option to automatically detect user account deletion in Azure Active Directory for your organization, this template starts scoring for risk indicators relating to these activities and how they correlate with user employment status. +When users leave your organization, there are specific risk indicators typically associated with data theft by departing users. This policy template uses exfiltration indicators for risk scoring and focuses on detection and alerts in this risk area. Data theft for departing users may include downloading files from SharePoint Online, printing files, and copying data to personal cloud messaging and storage services near their employment resignation and end dates. By using either the Microsoft HR connector or the option to automatically check for user account deletion in Azure Active Directory for your organization, this template starts scoring for risk indicators relating to these activities and how they correlate with user employment status. > [!IMPORTANT] > When using this template, you can configure a Microsoft 365 HR connector to periodically import resignation and termination date information for users in your organization. See the [Import data with the HR connector](import-hr-data.md) article for step-by-step guidance to configure the Microsoft 365 HR connector for your organization. If you choose not to use the HR connector, you must select the User account deleted from Azure AD option when configuring trigger events in the policy wizard. When using a *Data leaks* template, you can assign a DLP policy to trigger indic When creating or modifying DLP policies for use with insider risk management policies, consider the following guidelines: - Prioritize data exfiltration events and be selective when assigning **Incident reports** settings to *High* when configuring rules in your DLP policies. For example, emailing sensitive documents to a known competitor should be a *High* alert level exfiltration event. Over-assigning the *High* level in the **Incident reports** settings in other DLP policy rules can increase the noise in the insider risk management alert workflow and make it more difficult for your data investigators and analysts to properly evaluate these alerts. For example, assigning *High* alert levels to access denial activities in DLP policies makes it more challenging to evaluate truly risky user behavior and activities.-- When using a DLP policy as the triggering event, make sure you understand and properly configure the in-scope users in both the DLP and insider risk management policies. Only users defined as in-scope for insider risk management policies using the **Data leaks** template will have high severity DLP policy alerts processed. Additionally, only users defined as in-scope in a rule for a high severity DLP alert will be examined by the insider risk management policy for consideration. It's important that you don't unknowingly configure in-scope users in both your DLP and insider risk policies in a conflicting manner.+- When using a DLP policy as the triggering event, make sure you understand and properly configure the in-scope users in both the DLP and insider risk management policies. Only users defined as in-scope for insider risk management policies using the **Data leaks** template will have high severity DLP policy alerts processed. Additionally, only users defined as in-scope in a rule for a high severity DLP alert will be analyzed by the insider risk management policy for consideration. It's important that you don't unknowingly configure in-scope users in both your DLP and insider risk policies in a conflicting manner. For example, if your DLP policy rules are scoped to only users on the Sales Team and the insider risk policy created from the **Data leaks** template has defined all users as in-scope, the insider risk policy will only actually process high severity DLP alerts for the users on the Sales Team. The insider risk policy won't receive any high priority DLP alerts for users to process that aren't defined in the DLP rules in this example. Conversely, if your insider risk management policy created from **Data leaks** templates is scoped to only users on the Sales Team and the assigned DLP policy is scoped to all users, the insider risk policy will only process high severity DLP alerts for members of the Sales Team. The insider risk management policy will ignore high severity DLP alerts for all users not on the Sales Team. As with the **General data leaks template**, you can choose a DLP policy to trig ### Data leaks by disgruntled users (preview) -When users experience employment stressors, they may become disgruntled, which may increase the chances of insider risk activity. This template starts scoring user activity when an indicator associated with disgruntlement is identified. Examples include performance improvement notifications, poor performance reviews, or changes to job level status. Data leaks for disgruntled users may include downloading files from SharePoint Online and copying data to personal cloud messaging and storage services near employment stressor events. +When users experience employment stressors, they may become disgruntled, which may increase the chances of insider risk activity. This template starts scoring security and compliance related user activity when an indicator associated with disgruntlement is identified. Examples include system signals performance improvement notifications, poor performance reviews, or changes to job level status. Data leaks for disgruntled users may include downloading files from SharePoint Online and copying data to personal cloud messaging and storage services near employment stressor events. When using this template, you must also configure a Microsoft 365 HR connector to periodically import performance improvement notifications, poor performance review status, or job level change information for users in your organization. See the [Import data with the HR connector](import-hr-data.md) article for step-by-step guidance to configure the Microsoft 365 HR connector for your organization. Protecting healthcare record data and preventing the misuse of patient personal This policy template enables risk scoring for internal users that detects suspicious activities associated with records hosted on existing electronic medical record (EMR) systems. Detection focuses on unauthorized access, viewing, modification, and export of patient data. You'll need to configure a connector the [Microsoft Healthcare connector](import-healthcare-data.md) or [Epic connector](import-epic-data.md) to support detection of access, exfiltration, or obfuscation activities in your EMR system. -When using this template, you must also configure a Microsoft 365 HR connector to periodically import organization profile data for users in your organization. See the [Set up a connector to import HR data](/microsoft-365/compliance/import-hr-data) article for step-by-step guidance to configure the Microsoft 365 HR connector for your organization. +When using this template, you must also configure a Microsoft HR connector to periodically import organization profile data for users in your organization. See the [Set up a connector to import HR data](/microsoft-365/compliance/import-hr-data) article for step-by-step guidance to configure the Microsoft 365 HR connector for your organization. ++### General risky browser usage (preview) ++Identifying user visitation to inappropriate or unacceptable web sites on organization devices and networks is an important part of minimizing security, legal, and regulatory risks. Users that inadvertently or purposefully visit these types of websites may expose the organization to legal actions from other users, violate regulatory requirements, elevate network security risks, or jeopardize current and future business operations and opportunities. This misuse is often defined in an organization's acceptable use policy for user devices and organization network resources but is often difficult to quickly identify and act upon. ++To help protect against these risks, this policy can help detect and enable risk scoring for web browsing that might be in violation of your organization's acceptable use policy, such as visiting sites that pose a threat (for example phishing sites) or contain adult content. Several types of categories are available for automatic categorization of web browsing activities by in-scope users. ++When using this policy template, you'll need several prerequisites. For more information, see [Learn about and configure insider risk management browser signal detection](/microsoft-365/compliance/insider-risk-management-browser-support). ### Security policy violations by departing users (preview) -Departing users, whether leaving on positive or negative terms, may be higher risks for security policy violations. To help protect against inadvertent or malicious security violations for departing users, this policy template uses Defender for Endpoint alerts to provide insights into security-related activities. These activities include the user installing malware or other potentially harmful applications and disabling security features on their devices. By using either the [Microsoft 365 HR connector](import-hr-data.md) or the option to automatically detect user account deletion in Azure Active Directory for your organization, this template starts scoring for risk indicators relating to these security activities and how they correlate with user employment status. +Departing users, whether leaving on positive or negative terms, may be higher risks for security policy violations. To help protect against inadvertent or malicious security violations for departing users, this policy template uses Defender for Endpoint alerts to provide insights into security-related activities. These activities include the user installing malware or other potentially harmful applications and disabling security features on their devices. By using either the [Microsoft HR connector](import-hr-data.md) or the option to automatically check for user account deletion in Azure Active Directory for your organization, this template starts scoring for risk indicators relating to these security activities and how they correlate with user employment status. You'll need to have Microsoft Defender for Endpoint configured in your organization and enable Defender for Endpoint for insider risk management integration in the Defender Security Center to import security violation alerts. For more information on configuring Defender for Endpoint for insider risk management integration, see [Configure advanced features in Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/advanced-features#share-endpoint-alerts-with-microsoft-compliance-center). ### Security policy violations by priority users (preview) -Protecting against security violations for users in your organization may depend on their position, level of access to sensitive information, or risk history. Because security violations by priority users may have a significant impact on your organization's critical areas, this policy template starts scoring on these indicators and uses Microsoft Defender for Endpoint alerts to provide insights into security-related activities for these users. These activities may include the priority users installing malware or other potentially harmful applications and disabling security features on their devices. Priority users are defined in priority user groups configured in the insider risk management settings area. +Protecting against security violations for users in your organization may depend on their position, level of access to sensitive information, or risk history. Because security violations by priority users may have a significant impact on your organization's critical areas, this policy template starts scoring on these indicators, and uses Microsoft Defender for Endpoint alerts to provide insights into security-related activities for these users. These activities may include the priority users installing malware or other potentially harmful applications and disabling security features on their devices. Priority users are defined in priority user groups configured in the insider risk management settings area. You'll need to have Microsoft Defender for Endpoint configured in your organization and enable Defender for Endpoint for insider risk management integration in the Defender Security Center to import security violation alerts. For more information on configuring Defender for Endpoint for insider risk management integration, see [Configure advanced features in Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/advanced-features#share-endpoint-alerts-with-microsoft-compliance-center). Additionally, you'll need to assign priority user groups created in **Insider risk management** > **Settings** > **Priority user groups** to the policy. You'll need to have Microsoft Defender for Endpoint configured in your organizat Users that experience employment stressors may be at a higher risk for inadvertent or malicious security policy violations. These stressors may include the user being placed on a performance improvement plan, poor performance review status, or being demoted from their current position. This policy template starts risk scoring based on these indicators and activities associated with these events for these users. -When using this template, you must also configure a Microsoft 365 HR connector to periodically import performance improvement notifications, poor performance review status, or job level change information for users in your organization. See the [Import data with the HR connector](import-hr-data.md) article for step-by-step guidance to configure the Microsoft 365 HR connector for your organization. +When using this template, you must also configure a Microsoft HR connector to periodically import system signals related to performance improvement notifications, poor performance review status, or job level change information for users in your organization. See the [Import data with the HR connector](import-hr-data.md) article for step-by-step guidance to configure the Microsoft HR connector for your organization. You'll also need to have Microsoft Defender for Endpoint configured in your organization and enable Defender for Endpoint for insider risk management integration in the Defender Security Center to import security violation alerts. For more information on configuring Defender for Endpoint for insider risk management integration, see [Configure advanced features in Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/advanced-features#share-endpoint-alerts-with-microsoft-compliance-center). The following table lists the triggering events and prerequisites for policies c | **Data theft by departing users** | Resignation or termination date indicator from HR connector or Azure Active Directory account deletion | (optional) Microsoft 365 HR connector configured for termination and resignation date indicators | | **General data leaks** | Data leak policy activity that creates a *High severity* alert or built-in exfiltration event triggers | DLP policy configured for *High severity* alerts <br><br> OR <br><br> Customized triggering indicators | | **Data leaks by priority users** | Data leak policy activity that creates a *High severity* alert or built-in exfiltration event triggers | DLP policy configured for *High severity* alerts <br><br> OR <br><br> Customized triggering indicators <br><br> Priority user groups configured in insider risk settings |-| **Data leaks by disgruntled users** | Performance improvement, poor performance, or job level change indicators from HR connector | Microsoft 365 HR connector configured for disgruntlement indicators | +| **Data leaks by disgruntled users** | Performance improvement, poor performance, or job level change indicators from HR connector | Microsoft HR connector configured for disgruntlement indicators | | **General security policy violations** | Defense evasion of security controls or unwanted software detected by Microsoft Defender for Endpoint | Active Microsoft Defender for Endpoint subscription <br><br> Microsoft Defender for Endpoint integration with Microsoft Purview compliance portal configured | | **General patient data misuse** | Defense evasion of security controls from EMR systems <br><br> User and patient address matching indicators from HR systems | Healthcare access indicators selected in policy or insider risk settings <br><br> Microsoft 365 HR connector configured for address matching <br><br> Microsoft Healthcare or Epic connector configured |+| **General risky browser usage** | User browsing activity related to security that matches at least one selected *Browsing indicator* | See the complete list of prerequisites in the [browser signal detection article](/microsoft-365/compliance/insider-risk-management-browser-support) | | **Security policy violations by departing users** | Resignation or termination date indicators from HR connector or Azure Active Directory account deletion | (optional) Microsoft 365 HR connector configured for termination and resignation date indicators <br><br> Active Microsoft Defender for Endpoint subscription <br><br> Microsoft Defender for Endpoint integration with Microsoft Purview compliance portal configured | | **Security policy violations by priority users** | Defense evasion of security controls or unwanted software detected by Microsoft Defender for Endpoint | Active Microsoft Defender for Endpoint subscription <br><br> Microsoft Defender for Endpoint integration with Microsoft Purview compliance portal configured <br><br> Priority user groups configured in insider risk settings | | **Security policy violations by disgruntled user** | Performance improvement, poor performance, or job level change indicators from HR connector | Microsoft 365 HR connector configured for disgruntlement indicators <br><br> Active Microsoft Defender for Endpoint subscription <br><br> Microsoft Defender for Endpoint integration with Microsoft Purview compliance portal configured | For example, your organization has a dedicated SharePoint site for a highly conf When you create an insider risk management policy in the policy wizard, you can choose from the following priorities: -- **SharePoint sites**: Any activity associated with all file types in defined SharePoint sites is assigned a higher risk score. Users configuring the policy and selecting priority SharePoint sites can select SharePoint sites that they have permission to access. If SharePoint sites aren't available for selection in the policy by the current user, another user with the required permissions can select the sites for the policy later or the current user should be given access to the required sites.+- **SharePoint sites**: Any activity associated with all file types in defined SharePoint sites is assigned a higher risk score. Users configuring the policy and selecting priority SharePoint sites can select SharePoint sites that they have permission to access. If SharePoint sites aren't available for selection in the policy by the current user, another user with the required permissions can select the sites for the policy later, or the current user should be given access to the required sites. - **Sensitive information types**: Any activity associated with content that contains [sensitive information types](sensitive-information-type-entity-definitions.md) are assigned a higher risk score. - **Sensitivity labels**: Any activity associated with content that has specific [sensitivity labels](sensitivity-labels.md) applied are assigned a higher risk score. - **File extensions**: Any activity associated with content that has specific file extensions. Users configuring a data theft/leak policy that select **File extensions to prioritize** in the policy wizard can define up to 50 file extensions to prioritize in the policy. Entered extensions can include or omit a '.' as the first character of the prioritized extension.+- **Trainable classifiers**: Any activity associated with content that is included in a [trainable classifier](/microsoft-365/compliance/classifier-learn-about). Users configuring a policy that select Trainable classifiers in the policy wizard can select up to 5 trainable classifiers to apply to the policy. These classifiers can be existing classifiers that identify patterns of sensitive information like social security, credit card, or bank account numbers or custom classifiers created in your organization. -## Sequence detection +## Sequence detection (preview) Risky activities may not occur as isolated events. These risks are frequently part of a larger sequence of events. A sequence is a group of two or more user activities performed one after the other that might suggest an elevated risk. Identifying these related activities is an important part of evaluating overall risk. When sequence detection is enabled for data theft or data leaks policies, insights from sequence information activities are displayed on the **User activity** tab within an insider risk management case. The following policy templates support sequence detection: To learn more about sequence detection management in the **User activity** view, ## Cumulative exfiltration detection (preview) -Insider risk indicators help identify unusual levels of risk activities when evaluated daily for users that are in-scope for insider risk policies. Cumulative exfiltration detection uses machine learning models to help you identify when exfiltration activities that a user performs over a certain time exceeds the normal amount performed by users in your organization for the past 30 days over multiple exfiltration activity types. For example, if a user shared more files than most users over the past month, this activity would be detected and classified as a cumulative exfiltration activity. +With privacy on by default, insider risk indicators help identify unusual levels of risk activities when evaluated daily for users that are in-scope for insider risk policies. Cumulative exfiltration detection uses machine learning models to help you identify when exfiltration activities that a user performs over a certain time exceeds the normal amount performed by users in your organization for the past 30 days over multiple exfiltration activity types. For example, if a user shared more files than most users over the past month, this activity would be detected and classified as a cumulative exfiltration activity. Insider risk management analysts and investigators may use cumulative exfiltration detection insights to help identify exfiltration activities that may not typically generate alerts but are above what is typical for their organization. Some examples may be departing users slowly exfiltrate data across a range of days, or when users repeatedly share data across multiple channels more than usual for data sharing for your organization. Higher risk scores are assigned to cumulative exfiltration activities for SharePoint sites, sensitive information types, and content with [sensitivity labels](/microsoft-365/compliance/sensitivity-labels#label-priority-order-matters) configured as priority content in a policy or for activity involving labels configured as high priority in Microsoft Purview Information Protection. For more details about any recommendations or warnings, select a policy on the * Use the following table to learn more about recommendations and warning notifications and actions to take to resolve potential issues. -|Notification messages|Policy templates|Causes / Try this action to fix| -|||| -|Policy isn't assigning risk scores to activity|All policy templates|You may want to review your policy scope and triggering event configuration so that the policy can assign risk scores to activities <br><br> 1. Review the users that are selected for the policy. If you have few users selected, you may want to select additional users. <br> 2. If you're using an HR connector, check that your HR connector is sending the correct data. <br> 3. If you're using a DLP policy as your triggering event, check your DLP policy configuration to ensure it's configured to be used in this policy. <br> 4. For security violation policies, review the Microsoft Defender for Endpoint alert triage status selected in Insider risk settings > Intelligent detections. Confirm that the alert filter isn't too narrow.| -|Policy hasn't generated any alerts|All policy templates|You may want to review your policy configuration so that you're analyzing the scoring the activity that you care about. <br><br> 1. Confirm that you've selected indicators that you want to score. The more indicators selected, the more activities are assigned risk scores. <br> 2. Review threshold customization for policy. If the thresholds selected don't align with your organization's risk tolerance, adjust the selections so that alerts are created based on your preferred thresholds. <br> 3. Review the users and groups selected for the policy. Confirm you've selected all of the applicable users and groups. <br> 4. For security violation policies, confirm you've selected the alert triage status that you want to score for Microsoft Defender for Endpoint alerts in Intelligent Detections in settings.| -|No users or groups are included in this policy|All policy templates|Users or groups aren't assigned to the policy. <br><br> Edit your policy and select users or groups for the policy.| -|No indicators have been selected for this policy|All policy templates|Indicators haven't been selected for the policy <br><br> Edit your policy and select appropriate policy indicators for the policy.| -|No priority user groups are included in this policy|- Data leaks by priority users <br> - Security policy violations by priority users|Priority user groups aren't assigned to the policy. <br><br> Configure priority user groups in Insider risk management settings and assign priority user groups to the policy.| -|No triggering event has been selected for this policy|All policy templates|A triggering event isn't configured for the policy <br><br> Risk scores won't be assigned to user activities until you edit the policy and select a triggering event.| -|HR connector isn't configured or working as expected|- Data theft by departing user <br> - Security policy violations by departing user <br> - Data leaks by disgruntled users <br> - Security policy violations by disgruntled users|There's an issue with the HR connector. <br><br> 1. If you're using an HR connector, check that your HR connector is sending correct data <br><br> OR <br><br> 2. Select the Azure AD account deleted triggering event.| -|No devices are onboarded|- Data theft by departing users <br> - General data leaks <br> - Data leaks by disgruntled users <br> - Data Leaks by priority users|Device indicators are selected but there aren't any devices onboarded to the Microsoft 365 <br><br> Check whether devices are onboarded and meet requirements.| -|HR connector hasn't uploaded data recently|- Data theft by departing user <br> - Security policy violations by departing user <br> - Data leaks by disgruntled users <br> - Security policy violations by disgruntled users|HR connector hasn't imported data in more than 7 days. <br><br> Check that your HR connector is configured correctly and sending data.| -|We're unable to check the status of your HR connector right now, please check again later|- Data theft by departing user <br> - Security policy violations by departing user <br> - Data leaks by disgruntled users <br> - Security policy violations by disgruntled users|The insider risk management solution is unable to check the status of your HR connector. <br><br> Check that your HR connector is configured correctly and sending data, or come back and check the policy status.| -|DLP policy isn't selected as the triggering event|- General Data leaks <br> - Data leaks by priority users|A DLP policy hasn't been selected as a triggering event or the selected DLP policy has been deleted. <br><br> Edit the policy and either select an active DLP policy or 'User performs an exfiltration activity' as the triggering event in the policy configuration.| -|DLP policy used in this policy is turned off|- General Data leaks <br> - Data leaks by priority users|DLP policy used in this policy is turned off. <br><br> 1. Turn the DLP policy assigned to this policy on. <br><br> OR <br><br> 2. Edit this policy and either select a new DLP policy or 'User performs an exfiltration activity' as the triggering event in the policy configuration.| -|DLP policy doesn't meet requirements|- General Data leaks <br> - Data leaks by priority users|DLP policies used as triggering events must be configured to generate high severity alerts. <br><br> 1. Edit your DLP policy to assign applicable alerts as *High severity*. <br><br> OR <br><br> 2. Edit this policy and select *User performs an exfiltration activity* as the triggering event.| -|Your organization doesn't have a Microsoft Defender for Endpoint subscription|- General security policy violations <br> - Security policy violations by departing users <br> - Security policy violations by disgruntled users <br> - Security policy violations by priority users|An active Microsoft Defender for Endpoint subscription wasn't detected for your organization. <br><br> Until a Microsoft Defender for Endpoint subscription is added, these policies won't assign risk scores to user activity.| -|Microsoft Defender for Endpoint alerts aren't being shared with the compliance portal|- General security policy violations <br> - Security policy violations by departing users <br> - Security policy violations by disgruntled users <br> - Security policy violations by priority users|Microsoft Defender for Endpoint alerts aren't being shared with the compliance portal. <br><br> Configure sharing of Microsoft Defender for Endpoint alerts.| -|You're approaching the maximum limit of users being actively scored for this policy template.|All policy templates|Each policy template has a maximum number of in-scope users. See the template limit section details. <br><br> Review the users in the Users tab and remove any users who don't need to be scored anymore.| -|Triggering event is repeatedly occurring for over 15% of users in this policy.|All policy templates|Adjust the triggering event to help reduce how often users are brought into the policy scope.| +|**Notification messages**|**Policy templates**|**Causes / Try this action to fix**| +|:|:-|:-| +|**Policy isn't assigning risk scores to activity**| All policy templates | You may want to review your policy scope and triggering event configuration so that the policy can assign risk scores to activities <br><br> 1. Review the users that are selected for the policy. If you have few users selected, you may want to select additional users. <br> 2. If you're using an HR connector, check that your HR connector is sending the correct data. <br> 3. If you're using a DLP policy as your triggering event, check your DLP policy configuration to ensure it's configured to be used in this policy. <br> 4. For security violation policies, review the Microsoft Defender for Endpoint alert triage status selected in Insider risk settings > Intelligent detections. Confirm that the alert filter isn't too narrow.| +|**Policy hasn't generated any alerts**| All policy templates|You may want to review your policy configuration so that you're analyzing the most relevant scoring activity. <br><br> 1. Confirm that you've selected indicators that you want to score. The more indicators selected, the more activities are assigned risk scores. <br> 2. Review threshold customization for policy. If the thresholds selected don't align with your organization's risk tolerance, adjust the selections so that alerts are created based on your preferred thresholds. <br> 3. Review the users and groups selected for the policy. Confirm you've selected all of the applicable users and groups. <br> 4. For security violation policies, confirm you've selected the alert triage status that you want to score for Microsoft Defender for Endpoint alerts in Intelligent Detections in settings.| +|**No users or groups are included in this policy**| All policy templates | Users or groups aren't assigned to the policy. <br><br> Edit your policy and select users or groups for the policy.| +|**No indicators have been selected for this policy**| All policy templates | Indicators haven't been selected for the policy <br><br> Edit your policy and select appropriate policy indicators for the policy.| +|**No priority user groups are included in this policy**|- Data leaks by priority users <br> - Security policy violations by priority users|Priority user groups aren't assigned to the policy. <br><br> Configure priority user groups in Insider risk management settings and assign priority user groups to the policy.| +|**No triggering event has been selected for this policy**| All policy templates | A triggering event isn't configured for the policy <br><br> Risk scores won't be assigned to user activities until you edit the policy and select a triggering event.| +|**HR connector isn't configured or working as expected**|- Data theft by departing user <br> - Security policy violations by departing user <br> - Data leaks by disgruntled users <br> - Security policy violations by disgruntled users|There's an issue with the HR connector. <br><br> 1. If you're using an HR connector, check that your HR connector is sending correct data <br><br> OR <br><br> 2. Select the Azure AD account deleted triggering event.| +|**No devices are onboarded**|- Data theft by departing users <br> - General data leaks <br> - Data leaks by disgruntled users <br> - Data Leaks by priority users|Device indicators are selected but there aren't any devices onboarded to the compliance portal <br><br> Check whether devices are onboarded and meet requirements.| +|**HR connector hasn't uploaded data recently**|- Data theft by departing user <br> - Security policy violations by departing user <br> - Data leaks by disgruntled users <br> - Security policy violations by disgruntled users|HR connector hasn't imported data in more than 7 days. <br><br> Check that your HR connector is configured correctly and sending data.| +|**We're unable to check the status of your HR connector right now, please check again later**|- Data theft by departing user <br> - Security policy violations by departing user <br> - Data leaks by disgruntled users <br> - Security policy violations by disgruntled users|The insider risk management solution is unable to check the status of your HR connector. <br><br> Check that your HR connector is configured correctly and sending data, or come back and check the policy status.| +|**DLP policy isn't selected as the triggering event**|- General Data leaks <br> - Data leaks by priority users|A DLP policy hasn't been selected as a triggering event or the selected DLP policy has been deleted. <br><br> Edit the policy and either select an active DLP policy or 'User performs an exfiltration activity' as the triggering event in the policy configuration.| +|**DLP policy used in this policy is turned off** |- General Data leaks <br> - Data leaks by priority users|DLP policy used in this policy is turned off. <br><br> 1. Turn the DLP policy assigned to this policy on. <br><br> OR <br><br> 2. Edit this policy and either select a new DLP policy or 'User performs an exfiltration activity' as the triggering event in the policy configuration.| +|**DLP policy doesn't meet requirements**|- General Data leaks <br> - Data leaks by priority users|DLP policies used as triggering events must be configured to generate high severity alerts. <br><br> 1. Edit your DLP policy to assign applicable alerts as *High severity*. <br><br> OR <br><br> 2. Edit this policy and select *User performs an exfiltration activity* as the triggering event.| +|**Your organization doesn't have a Microsoft Defender for Endpoint subscription**|- General security policy violations <br> - Security policy violations by departing users <br> - Security policy violations by disgruntled users <br> - Security policy violations by priority users|An active Microsoft Defender for Endpoint subscription wasn't detected for your organization. <br><br> Until a Microsoft Defender for Endpoint subscription is added, these policies won't assign risk scores to user activity.| +|**Microsoft Defender for Endpoint alerts aren't being shared with the compliance portal**|- General security policy violations <br> - Security policy violations by departing users <br> - Security policy violations by disgruntled users <br> - Security policy violations by priority users|Microsoft Defender for Endpoint alerts aren't being shared with the compliance portal. <br><br> Configure sharing of Microsoft Defender for Endpoint alerts.| +|**You're approaching the maximum limit of users being actively scored for this policy template**|All policy templates|Each policy template has a maximum number of in-scope users. See the template limit section details. <br><br> Review the users in the Users tab and remove any users who don't need to be scored anymore.| +|**Triggering event is repeatedly occurring for over 15% of users in this policy**|All policy templates|Adjust the triggering event to help reduce how often users are brought into the policy scope.| ## Policy template limits The limit for each policy is calculated based on the total number of unique user Use the following table to determine the maximum number of in-scope users supported for each policy template: -|Policy template|Current in-scope user maximum| -||| +|**Policy template**|**Current in-scope user maximum**| +|:|:--| |General data leak|15,000| |Data leak by disgruntled users|7,500| |Data leak by priority users|1,000| |Data theft by departing users|20,000| |General security policy violations|1,000| |General patient data misuse|5,000|+|General risky browser usage|7,000| |Security policy violation by priority users|1,000| |Security policy violations by departing users|15,000| |Security policy violations by disgruntled users|7,500| ## Create a new policy -To create a new insider risk management policy, you'll use the policy wizard in **Insider risk management** solution in the Microsoft Purview compliance portal. +To create a new insider risk management policy, you'll generally use the policy wizard in **Insider risk management** solution in the Microsoft Purview compliance portal. You can also create quick policies for general data leaks and data theft by departing users from Analytics scans if applicable. -Complete the following steps to create a new policy: +Complete the following steps to create a new policy using the policy wizard: 1. In the [Microsoft Purview compliance portal](https://compliance.microsoft.com), go to **Insider risk management** and select the **Policies** tab. 2. Select **Create policy** to open the policy wizard. 3. On the **Policy template** page, choose a policy category and then select the template for the new policy. These templates are made up of conditions and indicators that define the risk activities you want to detect and investigate. Review the template prerequisites, triggering events, and detected activities to confirm this policy template fits your needs. > [!IMPORTANT]- > Some policy templates have prerequisites that must be configured for the policy to generate relevant alerts. If you haven't configured the applicable policy prerequisites, see **Step 4** above. + > Some policy templates have prerequisites that must be configured for the policy to generate relevant alerts. If you haven't configured the applicable policy prerequisites, see **Step 4** in the [Get started with insider risk management](/microsoft-365/compliance/insider-risk-management-configure). 4. Select **Next** to continue. 5. On the **Name and description** page, complete the following fields: Complete the following steps to create a new policy: If you've selected at least one *Office* or *Device* indicator, select the **Risk score boosters** as appropriate. Risk score boosters are only applicable for selected indicators. If you've selected a *Data theft* or *Data leaks* policy template, select one or more **Sequence detection** methods and a **Cumulative exfiltration detection** method to apply to the policy.+ If you've selected the *General risky browser usage* policy template, select one or more of the **Browsing indicators**. 20. Select **Next** to continue. 21. On the **Decide whether to use default or custom indicator thresholds** page, choose custom or default thresholds for the policy indicators that you've selected. Choose either the **Use default thresholds for all indicators** or **Specify custom thresholds** for the selected policy indicators. If you've selected Specify custom thresholds, choose the appropriate level to generate the desired level of activity alerts for each policy indicator. Complete the following steps to manage an existing policy: 2. On the policy dashboard, select the policy you want to manage. 3. On the policy details page, select **Edit policy** 4. In the policy wizard, you can't edit the following:- - **Policy template**: The template used to define the types of risk indicators detected by the policy. + - **Policy template**: The template used to define the types of risk indicators checked by the policy. - **Name**: The friendly name for the policy 5. On the **Name and description** page, update the description for the policy in the **Description** field. 6. Select **Next** to continue.-7. On the **Users and groups** page, select **Include all users and groups** or **Include specific users and groups** to define which users or groups are included in the policy, or if you've chosen a priority users-based template; select **Add or edit priority user groups**. Selecting **Include all users and groups** will look for triggering events for all users and groups in your organization to start assigning risk scores for the policy. Selecting **Include specific users and groups** allows you to define which users and groups to assign to the policy. Guest user accounts aren't supported. +7. On the **Users and groups** page, select **Include all users and groups** or **Include specific users and groups** to define which users or groups are included in the policy, or if you've chosen a priority users-based template; select **Add or edit priority user groups**. Selecting **Include all users and groups** will look for triggering security and compliance related events for all users and groups in your organization to start assigning risk scores for the policy. Selecting **Include specific users and groups** allows you to define which users and groups to assign to the policy. Guest user accounts aren't supported. 8. Select **Next** to continue. 9. On the **Content to prioritize** page, you can assign (if needed) the sources to prioritize, which increases the chance of generating a high severity alert for these sources. Select one of the following choices: Complete the following steps to copy an existing policy: 3. On the policy details page, select Copy. 4. In the policy wizard, name the new policy and update the policy configuration as needed. -## Immediately start scoring user activity +## Immediately start scoring security-related user activity There may be scenarios where you need to immediately start assigning risk scores to users with insider risk policies outside of the insider risk management triggering event workflow. Use **Start scoring activity for users** on the **Policies** tab to manually add a user (or users) to one or more insider risk policies for a specific amount of time, to immediately start assigning risk scores to their activity, and to bypass the requirement for a user to have a triggering indicator (like a DLP policy match). You can also add a reason for adding the user to the policy, which will appear on the users' activity timeline. Users manually added to policies are displayed in the **Users** dashboard and alerts are created if activity meets the policy alert thresholds. |
| compliance | Insider Risk Management Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-settings.md | User activities detected by insider risk policies are assigned a specific risk s - **Default volume**: You'll see all high severity alerts and a balanced amount of medium and low severity alerts. - **More alerts**: You'll see all medium and high severity alerts and most low severity alerts. This setting level might result in more false positives. -### Microsoft Defender for Endpoint (preview) +### Microsoft Defender for Endpoint alert statuses (preview) [Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) is an enterprise endpoint security platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats. To have better visibility of security violations in your organization, you can import and filter Defender for Endpoint alerts for activities used in policies created from insider risk management security violation policy templates. For each of the following domain settings, you can enter up to 500 domains: - **Third party domains:** If your organization uses third-party domains for business purposes (such as cloud storage), include them here so you can receive alerts for activity related to the device indicator *Use a browser to download content from a third-party site*. +### File path exclusions ++By defining file paths to exclude, user activities that map to specific indicators and that occur in these file path locations won't generate policy alerts. Some examples are copying or moving files to a system folder or network share path. You can enter up to 500 file paths for exclusion. ++To add file paths to exclude, complete the following steps: ++1. In the compliance portal, navigate to **Insider risk management** > **Settings** > **Intelligent detections**. +2. In the **File path exclusion** section, select **Add file paths to exclude**. +3. On the **Add a file path** pane, enter an exact network share or device path to exclude from risk scoring. You can also use * and *([0-9]) to denote specific folders and sub-folders to be excluded. +4. Select **Add file paths** to exclude to configure the file path exclusions or **Close** to discard the changes. ++To delete a file path exclusion, select the file path exclusion and select **Delete**. ++### Default file path exclusions ++By default, several file paths are automatically excluded from generating policy alerts. Activities in these file paths are typically benign and could potentially increase the volume of non-actionable alerts. If needed, you can cancel the selection for these default file path exclusions to enable risk scoring for activities in these locations. ++The default file path exclusions are: ++- \Users\\\*\AppData +- \Users\\\*\AppData\Local +- \Users\\\*\AppData\Local\Roaming +- \Users\\\*\AppData\Local\Local\Temp ++The wildcards in these paths denote that all folder levels between the \Users and \AppData are included in the exclusion. For example, activities in *C:\Users\Test1\AppData\Local* and *C:\Users\Test2\AppData\Local*, *C:\Users\Test3\AppData\Local* (and so on) would all be included and not scored for risk as part of the *\Users\\\*\AppData\Local* exclusion selection. ++### Site URL exclusions ++Configure site URL exclusions to prevent potential risk activities that occur in SharePoint (and SharePoint sites associated with Team channel sites) from generating policy alerts. You might want to consider excluding sites and channels that contain non-sensitive files and data that can be shared with stakeholders or the public. You can enter up to 500 site URL paths to exclude. ++To add site URL paths to exclude, complete the following steps: ++1. In the compliance portal, navigate to **Insider risk management** > **Settings** > **Intelligent detections**. +2. In the **Site URL exclusion** section, select **Add or edit SharePoint sites**. +3. On the **Add or edit SharePoint sites** pane, enter or search for the SharePoint site to exclude from risk scoring. You'll only see SharePoint sites that you have permission to access. +4. Select **Add** to configure the site URL exclusions or **Cancel** to discard the changes. ++To edit site URL paths to exclude, complete the following steps: ++1. In the compliance portal, navigate to **Insider risk management** > **Settings** > **Intelligent detections**. +2. In the **Site URL exclusion** section, select **Add or edit SharePoint sites**. +3. On the **Add or edit SharePoint sites** pane, enter or search for the SharePoint site to exclude from risk scoring. You'll only see SharePoint sites that you have permission to access. +4. Select **Edit** to configure the site URL exclusions or **Cancel** to discard the changes. ++To delete a Site URL exclusion, select the site URL exclusion and select **Delete**. ++### Keyword exclusions ++Configure exclusions for keywords that appear in file names, file paths, or email message subject lines. This allows flexibility for organizations that need to reduce potential alert noise due to flagging of benign terms specified for your organization. Such activities related to files or email subjects containing the keyword will be ignored by your insider risk management policies and won't generate alerts. You can enter up to 500 keywords to exclude. ++Use the **Exclude only if it does not contain** field to define specific groupings of terms to ignore for exclusion, For example, if you want to exclude the keyword 'training,' but not exclude 'compliance training,' you would enter 'compliance' (or 'compliance training') in the **Exclude only if it does not contain** field and 'training' in the **But does contain** field. ++If you just want to exclude specific standalone terms, enter the terms in the **But does contain field** only. ++To add standalone keywords to exclude, complete the following steps: ++1. In the compliance portal, navigate to **Insider risk management** > **Settings** > **Intelligent detections**. +2. In the **Keyword exclusion** section, enter the standalone keywords in the **But does contain** field. +3. Select **Save** to configure the keyword exclusions. ++To delete a standalone keyword to exclude, complete the following steps: ++1. In the compliance portal, navigate to **Insider risk management** > **Settings** > **Intelligent detections**. +2. In the **Keyword exclusion** section, select the *X* for the specific standalone keyword in the **But does contain** field. Repeat as needed to remove multiple keywords. +3. Select **Save** to delete the keyword exclusions. + ## Export alerts Insider risk management alert information is exportable to security information and event management (SIEM) and security orchestration automated response (SOAR) solutions by using the [Office 365 Management Activity API schema](/office/office-365-management-api/office-365-management-activity-api-schema#security-and-compliance-alerts-schema). You can use the Office 365 Management Activity APIs to export alert information to other applications your organization may use to manage or aggregate insider risk information. Alert information is exported and available every 60 minutes via the Office 365 Management Activity APIs. |
| compliance | Insider Risk Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management.md | In most cases, users try their best to properly handle sensitive or confidential - [Data leaks by priority users (preview)](insider-risk-management-policies.md#data-leaks-by-priority-users-preview) - [Data leaks by disgruntled users (preview)](insider-risk-management-policies.md#data-leaks-by-disgruntled-users-preview) -## Intentional or unintentional security policy violations (preview) +### Intentional or unintentional security policy violations (preview) Users typically have a large degree of control when managing their devices in the modern workplace. This control may include permissions to install or uninstall applications needed in the performance of their duties or the ability to temporarily disable device security features. Whether this activity is inadvertent, accidental, or malicious, this conduct can pose risk to your organization and is important to identify and act to minimize. To help identify these risky security activities, the following insider risk management security policy violation templates scores security risk indicators and uses Microsoft Defender for Endpoint alerts to provide insights for security-related activities: Users typically have a large degree of control when managing their devices in th - [Security policy violations by priority users (preview)](insider-risk-management-policies.md#security-policy-violations-by-priority-users-preview) - [Security policy violations by disgruntled users (preview)](insider-risk-management-policies.md#security-policy-violations-by-disgruntled-users-preview) -## Policies for users based on position, access level, or risk history (preview) +### Policies for users based on position, access level, or risk history (preview) Users in your organization may have different levels of risk depending on their position, level of access to sensitive information, or risk history. This structure may include members of your organization's executive leadership team, IT administrators that have extensive data and network access privileges, or users with a past history of risky activities. In these circumstances, closer inspection and more aggressive risk scoring are important to help surface alerts for investigation and quick action. To help identify risky activities for these types of users, you can create priority user groups and create policies from the following policy templates: - [Security policy violations by priority users (preview)](insider-risk-management-policies.md#security-policy-violations-by-priority-users-preview) - [Data leaks by priority users (preview)](insider-risk-management-policies.md#data-leaks-by-priority-users-preview) -## Healthcare (preview) +### Healthcare (preview) For organizations in the healthcare industry, recent studies have found a very high rate of insider-related data breaches. Detecting misuse of patient data and health record information is a critical component of safeguarding patient privacy and complying with compliance regulation such as the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act. Patient data misuse can range from accessing privileged patient records to accessing records of patients from family or neighbors with malicious intent. To help identity these types of risky activities, the following insider risk management policy templates use the Microsoft 365 HR connector and a healthcare-specific data connector to start scoring risk indicators relating to behaviors that may occur within your electronic heath record (EHR) systems: - [General patient data misuse (preview)](insider-risk-management-policies.md#general-patient-data-misuse-preview) -## Actions and behaviors by disgruntled users (preview) +### Actions and behaviors by disgruntled users (preview) Employment stresses events can impact user behavior in several ways that relate to insider risks. These stressors may be a poor performance review, a position demotion, or the user being placement on a performance review plan. Though most users don't respond maliciously to these events, the stress of these actions may result in some users to behave in ways they may not normally consider during normal circumstances. To help identify these types of risky activities, the following insider risk management policy templates use the Microsoft 365 HR connector and starts scoring risk indicators relating to behaviors that may occur near employment stressor events: - [Data leaks by disgruntled users (preview)](insider-risk-management-policies.md#data-leaks-by-disgruntled-users-preview) - [Security policy violations by disgruntled users (preview)](insider-risk-management-policies.md#security-policy-violations-by-disgruntled-users-preview) +### Risky browser usage that could result in a security incident (preview) ++Most organizations provide users with rules and guidelines that clarify how an organization's devices and internet access should be used. These policies help protect both the organization and users from security and regulatory risks. To help identity these types of risky actions, the following insider risk management policy template can help detect and enable risk scoring for web browsing behaviors that might result in a data security incident, such as visiting sites that provide malware or hacking tools. ++- [General risky browser usage (preview)](insider-risk-management-policies.md#general-risky-browser-usage-preview) + ## Ready to get started? - See [Plan for insider risk management](insider-risk-management-plan.md) for how to prepare to enable insider risk management policies in your organization. |
| compliance | Sensitivity Labels Default Sharing Link | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-default-sharing-link.md | To apply the default sharing link type for sites, sensitivity labels must be ena To apply the default sharing link type for documents in SharePoint and OneDrive, sensitivity labels must be enabled for these services. If this capability isn't yet enabled for your tenant, see [How to enable sensitivity labels for SharePoint and OneDrive (opt-in)](sensitivity-labels-sharepoint-onedrive-files.md#how-to-enable-sensitivity-labels-for-sharepoint-and-onedrive-opt-in). -In a PowerShell session, you must [connect to Office 365 Security & Compliance PowerShell](/powershell/exchange/office-365-scc/connect-to-scc-powershell/connect-to-scc-powershell) to configure the settings for the default sharing link type. +In a PowerShell session, you must [connect to Security & Compliance PowerShell](/powershell/exchange/office-365-scc/connect-to-scc-powershell/connect-to-scc-powershell) to configure the settings for the default sharing link type. > [!NOTE] > Although not required, it's easiest to first [create and configure sensitivity labels in the Microsoft Purview compliance portal](create-sensitivity-labels.md), and then modify these labels with the settings that configure the default sharing link type. In a PowerShell session, you must [connect to Office 365 Security & Compliance P The configuration settings for the default sharing link type use the PowerShell *AdvancedSettings* parameter with the [Set-Label](/powershell/module/exchange/set-label) and [New-Label](/powershell/module/exchange/new-labelpolicy) cmdlets from [Security & Compliance PowerShell](/powershell/exchange/scc-powershell): - **DefaultSharingScope**: The available values are:- - **SpecificPeople**: Sets the default sharing link for the site to the "Specific people" link - - **Organization**: Sets the default sharing link for the site to the "organization" link or company shareable link - - **Anyone**: Sets the default sharing link for the site to an Anonymous Access or Anyone link + - **SpecificPeople**: Sets the default sharing link to specific people (only the people the user specifies) + - **Organization**: Sets the default sharing link for only people in your organization + - **Anyone**: Sets the default sharing link to anyone with the link, which is equivalent to anonymous access - **DefaultShareLinkPermission**: The available values are:- - **View**: Sets the default link permission for the site to "view" permissions - - **Edit**: Sets the default link permission for the site to "edit" permissions + - **View**: Sets the default link permission to view permissions + - **Edit**: Sets the default link permission to edit permissions These two settings and values are the equivalent of the parameters *DefaultSharingScope* and *DefaultShareLinkPermission* from the [Set-SPOSite](/powershell/module/sharepoint-online/set-sposite) cmdlet. +Another configuration for the default sharing link type is to use the **DefaultShareLinkToExistingAccess** advanced setting, which is the equivalent of the parameter *DefaultLinkToExistingAccess* from the [Set-SPOSite](/powershell/module/sharepoint-online/set-sposite) cmdlet. When you set this value to **True**, it overrides the other two advanced settings and their values. + PowerShell examples, where the sensitivity label GUID is **8faca7b8-8d20-48a3-8ea2-0f96310a848e**: - To set the default sharing link type to SpecificPeople: PowerShell examples, where the sensitivity label GUID is **8faca7b8-8d20-48a3-8e Set-Label -Identity 8faca7b8-8d20-48a3-8ea2-0f96310a848e -AdvancedSettings @{DefaultShareLinkPermission="Edit"} ```` +- To set the default sharing link type to people with existing access: + + ````powershell + Set-Label -Identity 8faca7b8-8d20-48a3-8ea2-0f96310a848e -AdvancedSettings @{DefaultShareLinkToExistingAccess="True"} + ```` + For more help to specify PowerShell advanced settings, see [PowerShell tips for specifying the advanced settings](create-sensitivity-labels.md#powershell-tips-for-specifying-the-advanced-settings). To configure the settings for the default sharing link type for a site, the [scope of the sensitivity label](sensitivity-labels.md#label-scopes) must include **Groups & sites** when you create the sensitivity label in the Microsoft Purview compliance portal. After it's created, you see this displayed as **Site, UnifiedGroup** in the **Scope** column on the **Labels** page, and the PowerShell *ContentType* setting also displays this same value. For documents, the scope must include **Items**, which displays as **File, Email**. Then: |
| enterprise | Tenant Roadmap Microsoft 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/tenant-roadmap-microsoft-365.md | To plan for your tenant implementation: - [Plan for client app support](microsoft-365-client-support-certificate-based-authentication.md) - [Determine how to use hybrid modern authentication](hybrid-modern-auth-overview.md) - [Plan for Office 2007 and Office 2010 upgrades](plan-upgrade-previous-versions-office.md)-- [Understand tenant isolation](/microsoft-365-isolation-in-microsoft-365?view=o365-worldwide&preserve-view=true)+- [Understand tenant isolation](/compliance/assurance/assurance-microsoft-365-isolation-controls#tenant-isolation) ### Deploy For more information, see [Microsoft 365 Multi-Geo](microsoft-365-multi-geo.md). ## Manage multiple Microsoft 365 tenants -Although having a single tenant for your oganization is ideal, you may be one of many organizations that have multiple tenants. Reasons can include mergers and aquisitions, you want administrative isolation, or you have a decentralized IT. +Although having a single tenant for your organization is ideal, you may be one of many organizations that have multiple tenants. Reasons can include mergers and acquisitions, you want administrative isolation, or you have a decentralized IT. If you have multiple Microsoft 365 tenants, see these articles for more information about: If you have multiple Microsoft 365 tenants, see these articles for more informat ## Next step -Start your tenant planning with [Subscriptions, licenses, accounts, and tenants](subscriptions-licenses-accounts-and-tenants-for-microsoft-cloud-offerings.md). +Start your tenant planning with [Subscriptions, licenses, accounts, and tenants](subscriptions-licenses-accounts-and-tenants-for-microsoft-cloud-offerings.md). |
| includes | Microsoft 365 Content Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/microsoft-365-content-updates.md | +## Week of September 05, 2022 +++| Published On |Topic title | Change | +|||--| +| 9/6/2022 | [About the Microsoft Purview Compliance Manager premium assessment trial](/microsoft-365/compliance/compliance-easy-trials-compliance-manager-assessments?view=o365-worldwide) | modified | +| 9/6/2022 | [Device health and compliance report in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/machine-reports?view=o365-worldwide) | modified | +| 9/6/2022 | [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 9/6/2022 | [Configure the delivery of third-party phishing simulations to users and unfiltered messages to SecOps mailboxes](/microsoft-365/security/office-365-security/configure-advanced-delivery?view=o365-worldwide) | modified | +| 9/6/2022 | [Microsoft recommendations for EOP and Defender for Office 365 security settings](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-worldwide) | modified | +| 9/6/2022 | [Choose your scenarios for Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-choose-scenarios?view=o365-worldwide) | modified | +| 9/6/2022 | [Start with a pilot deployment of Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-pilot?view=o365-worldwide) | modified | +| 9/6/2022 | [Microsoft 365 for frontline workers - scenario posters](/microsoft-365/frontline/flw-scenario-posters?view=o365-worldwide) | added | +| 9/6/2022 | [Frontline team collaboration](/microsoft-365/frontline/flw-team-collaboration?view=o365-worldwide) | modified | +| 9/6/2022 | [Message delegation](/microsoft-365/frontline/hc-delegates?view=o365-worldwide) | modified | +| 9/6/2022 | [Microsoft 365 for retail organizations](/microsoft-365/frontline/teams-for-retail-landing-page?view=o365-worldwide) | modified | +| 9/6/2022 | [Get started with Microsoft 365 for healthcare organizations](/microsoft-365/frontline/teams-in-hc?view=o365-worldwide) | modified | +| 9/6/2022 | [Attack surface reduction rules reporting](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-report?view=o365-worldwide) | added | +| 9/6/2022 | [What's new in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint?view=o365-worldwide) | modified | +| 9/6/2022 | [Anti-malware protection](/microsoft-365/security/office-365-security/anti-malware-protection?view=o365-worldwide) | modified | +| 9/6/2022 | [Preset security policies](/microsoft-365/security/office-365-security/preset-security-policies?view=o365-worldwide) | modified | +| 9/6/2022 | [Safe Attachments](/microsoft-365/security/office-365-security/safe-attachments?view=o365-worldwide) | modified | +| 9/6/2022 | [Complete Safe Links overview for Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/safe-links?view=o365-worldwide) | modified | +| 9/6/2022 | [Microsoft 365 productivity illustrations](/microsoft-365/solutions/productivity-illustrations?view=o365-worldwide) | modified | +| 9/8/2022 | [Bookings with me](/microsoft-365/bookings/bookings-in-outlook?view=o365-worldwide) | modified | +| 9/8/2022 | [Attack surface reduction (ASR) rules reporting](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-report?view=o365-worldwide) | modified | +| 9/8/2022 | [Enable Microsoft 365 support integration for ServiceNow Virtual Agent](/microsoft-365/admin/manage/servicenow-support-integration?view=o365-worldwide) | added | +| 9/8/2022 | [Enable archive mailboxes for Microsoft 365](/microsoft-365/compliance/enable-archive-mailboxes?view=o365-worldwide) | modified | +| 9/8/2022 | [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 9/9/2022 | [Microsoft 365 admin center activity reports](/microsoft-365/admin/activity-reports/activity-reports?view=o365-worldwide) | modified | +| 9/9/2022 | [Top 20 most-viewed admin help articles this month # < 60 chars](/microsoft-365/admin/top-m365-admin-articles?view=o365-worldwide) | modified | +| 9/9/2022 | [Manage sensitivity labels in Office apps](/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide) | modified | +| 9/9/2022 | [Manage submissions](/microsoft-365/security/office-365-security/admin-submission?view=o365-worldwide) | modified | +| 9/9/2022 | [Sign up for Microsoft 365 Business Basic](/microsoft-365/admin/setup/signup-business-basic?view=o365-worldwide) | added | +| 9/9/2022 | [Set up Microsoft 365 Business Basic](/microsoft-365/admin/setup/setup-business-basic?view=o365-worldwide) | modified | +| 9/9/2022 | [Accept an email invitation to a Microsoft 365 for business subscription (User)](/microsoft-365/admin/simplified-signup/user-invite-business-standard?view=o365-worldwide) | modified | +| 9/9/2022 | [Accept an email invitation to a Microsoft 365 for business subscription organization using an Outlook, Yahoo, Gmail or other account (User)](/microsoft-365/admin/simplified-signup/user-invite-msa-nodomain-join?view=o365-worldwide) | modified | +| 9/9/2022 | About the Microsoft Defender for Office 365 trial | removed | +| 9/9/2022 | [Allow or block emails using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/allow-block-email-spoof?view=o365-worldwide) | modified | +| 9/9/2022 | [Allow or block files using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/allow-block-files?view=o365-worldwide) | modified | +| 9/9/2022 | [Allow or block URLs using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/allow-block-urls?view=o365-worldwide) | modified | +| 9/9/2022 | [Try and evaluate Defender for Office 365](/microsoft-365/security/office-365-security/try-microsoft-defender-for-office-365?view=o365-worldwide) | modified | ++ ## Week of August 29, 2022 | 8/12/2022 | [Use drive shipping to import PST files](/microsoft-365/compliance/use-drive-shipping-to-import-pst-files-to-office-365?view=o365-worldwide) | modified | | 8/12/2022 | [Cross-tenant mailbox migration](/microsoft-365/enterprise/cross-tenant-mailbox-migration?view=o365-worldwide) | modified | | 8/12/2022 | [Manage data for Microsoft Whiteboard](/microsoft-365/whiteboard/manage-data-organizations?view=o365-worldwide) | modified |---## Week of August 01, 2022 ---| Published On |Topic title | Change | -|||--| -| 8/1/2022 | [Key infrastructure requirements before enrolling in the Microsoft Defender Experts for Hunting service](/microsoft-365/security/defender/before-you-begin-defender-experts?view=o365-21vianet) | added | -| 8/1/2022 | [What is Microsoft Defender Experts for Hunting offering](/microsoft-365/security/defender/defender-experts-for-hunting?view=o365-21vianet) | added | -| 8/1/2022 | [How to subscribe to Microsoft Defender Experts for Hunting](/microsoft-365/security/defender/onboarding-defender-experts-for-hunting?view=o365-21vianet) | added | -| 8/1/2022 | [Understand the Defender Experts for Hunting report in Microsoft 365 Defender](/microsoft-365/security/defender/defender-experts-report?view=o365-21vianet) | modified | -| 8/1/2022 | [How to enable DMARC Reporting for Microsoft Online Email Routing Address (MOERA) and parked Domains](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-enable-dmarc-reporting-for-microsoft-online-email-routing-address-moera-and-parked-domains?view=o365-21vianet) | modified | -| 8/1/2022 | [How to setup automated attacks and training within Attack simulation training](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-setup-attack-simulation-training-for-automated-attacks-and-training?view=o365-21vianet) | modified | -| 8/1/2022 | [Use Cost management in the Microsoft 365 admin center](/microsoft-365/commerce/use-cost-mgmt?view=o365-21vianet) | modified | -| 8/1/2022 | [Microsoft Defender for Endpoint Device Control Removable Storage Access Control, removable storage media](/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control?view=o365-21vianet) | modified | -| 8/1/2022 | [Migrating servers from Microsoft Defender for Endpoint to Microsoft Defender for Cloud](/microsoft-365/security/defender-endpoint/migrating-mde-server-to-cloud?view=o365-21vianet) | added | -| 8/1/2022 | [What's new in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-whats-new?view=o365-21vianet) | modified | -| 8/1/2022 | [Server migration scenarios for the new version of Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/server-migration?view=o365-21vianet) | modified | -| 8/1/2022 | [Glossary of security terms for Microsoft 365 security capabilities](/microsoft-365/business-premium/m365bp-glossary?view=o365-21vianet) | modified | -| 8/1/2022 | [Paying for your subscription](/microsoft-365/commerce/billing-and-payments/pay-for-your-subscription?view=o365-21vianet) | modified | -| 8/1/2022 | [Bulk import external contacts to Exchange Online](/microsoft-365/compliance/bulk-import-external-contacts?view=o365-21vianet) | modified | -| 8/1/2022 | [Microsoft Defender for Endpoint Device Control Removable Storage Protection](/microsoft-365/security/defender-endpoint/device-control-removable-storage-protection?view=o365-21vianet) | modified | -| 8/1/2022 | [What's new in Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-whatsnew?view=o365-21vianet) | modified | -| 8/1/2022 | [Submit files for analysis by Microsoft](/microsoft-365/security/intelligence/submission-guide?view=o365-21vianet) | modified | -| 8/2/2022 | [View your Threat & Vulnerability Management dashboard in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-view-tvm-dashboard?view=o365-21vianet) | modified | -| 8/2/2022 | [Configure Microsoft Defender for Endpoint risk signals using App Protection Policies (MAM)](/microsoft-365/security/defender-endpoint/android-configure-mam?view=o365-21vianet) | modified | -| 8/2/2022 | [Configure Microsoft Defender for Endpoint on Android features](/microsoft-365/security/defender-endpoint/android-configure?view=o365-21vianet) | modified | -| 8/2/2022 | [Allow or block emails using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/allow-block-email-spoof?view=o365-21vianet) | modified | -| 8/2/2022 | [Manage your allows and blocks in the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list?view=o365-21vianet) | modified | -| 8/3/2022 | [Microsoft 365 Group mailbox size management](/microsoft-365/admin/create-groups/group-mailbox-size-management?view=o365-21vianet) | added | -| 8/3/2022 | [What's new in Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-whatsnew?view=o365-21vianet) | modified | -| 8/3/2022 | [Migrating servers from Microsoft Defender for Endpoint to Microsoft Defender for Cloud](/microsoft-365/security/defender-endpoint/migrating-mde-server-to-cloud?view=o365-21vianet) | modified | -| 8/3/2022 | [Configure local overrides for Microsoft Defender Antivirus settings](/microsoft-365/security/defender-endpoint/configure-local-policy-overrides-microsoft-defender-antivirus?view=o365-21vianet) | modified | -| 8/4/2022 | [Export non product code software inventory assessment per device](/microsoft-365/security/defender-endpoint/get-assessment-non-cpe-software-inventory?view=o365-worldwide) | added | -| 8/4/2022 | [Export assessment methods and properties per device](/microsoft-365/security/defender-endpoint/get-assessment-methods-properties?view=o365-21vianet) | modified | -| 8/4/2022 | [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-21vianet) | modified | -| 8/4/2022 | [Performance analyzer for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/tune-performance-defender-antivirus?view=o365-21vianet) | modified | -| 8/4/2022 | [Paying for your subscription](/microsoft-365/commerce/billing-and-payments/pay-for-your-subscription?view=o365-21vianet) | modified | -| 8/4/2022 | [Help your clients and customers use virtual appointments](/microsoft-365/frontline/virtual-appointments-toolkit?view=o365-21vianet) | modified | -| 8/4/2022 | [Migrating servers from Microsoft Monitoring Agent to the unified solution](/microsoft-365/security/defender-endpoint/application-deployment-via-mecm?view=o365-21vianet) | modified | -| 8/5/2022 | [Use Microsoft Teams meetings with Blackboard Learn](/microsoft-365/lti/teams-meetings-with-blackboard-learn?view=o365-worldwide) | added | -| 8/5/2022 | [Guest users in the Microsoft 365 admin center](/microsoft-365/admin/add-users/about-guest-users?view=o365-worldwide) | modified | -| 8/5/2022 | [Manage guest access in Microsoft 365 groups](/microsoft-365/admin/create-groups/manage-guest-access-in-groups?view=o365-worldwide) | modified | -| 8/5/2022 | [Manage data for Microsoft Whiteboard](/microsoft-365/whiteboard/manage-data-organizations?view=o365-worldwide) | modified | -| 8/5/2022 | [Manage sharing for Microsoft Whiteboard in GCC High environments](/microsoft-365/whiteboard/manage-sharing-gcc-high?view=o365-worldwide) | modified | -| 8/5/2022 | [Manage sharing for Microsoft Whiteboard](/microsoft-365/whiteboard/manage-sharing-organizations?view=o365-worldwide) | modified | -| 8/5/2022 | [Microsoft 365 Business Premium overview](/microsoft-365/business-premium/index?view=o365-worldwide) | modified | -| 8/5/2022 | [Collaborate and share securely in Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-collaborate-share-securely?view=o365-worldwide) | modified | -| 8/5/2022 | [Set Up unmanaged devices overview](/microsoft-365/business-premium/m365bp-devices-overview?view=o365-worldwide) | modified | -| 8/5/2022 | [Set up and secure managed devices](/microsoft-365/business-premium/m365bp-protect-devices?view=o365-worldwide) | modified | -| 8/5/2022 | [Use email securely](/microsoft-365/business-premium/m365bp-protect-email-overview?view=o365-worldwide) | modified | -| 8/5/2022 | [Increase security in Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-security-overview?view=o365-worldwide) | modified | -| 8/5/2022 | [Welcome to Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-setup-overview?view=o365-worldwide) | modified | -| 8/5/2022 | [Set up Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-setup?view=o365-worldwide) | modified | -| 8/5/2022 | [Deploy, manage, and report on Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/deploy-manage-report-microsoft-defender-antivirus?view=o365-worldwide) | modified | -| 8/5/2022 | [Configure and manage Microsoft Threat Experts capabilities through Microsoft 365 Defender](/microsoft-365/security/defender/configure-microsoft-threat-experts?view=o365-worldwide) | modified | |
| includes | Microsoft 365 Multi Geo Locations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/microsoft-365-multi-geo-locations.md | |Korea |KOR |Southeast or East Asia datacenters| |North America |NAM |US datacenters | |Norway |NOR |(eDiscovery data location coming soon)| +|Qatar |QAT |(eDiscovery data location coming soon)| |South Africa |ZAF |Europe datacenters | |Sweden |SWE |Europe datacenters | |Switzerland |CHE |Europe datacenters | |
| security | Ios Configure Features | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/ios-configure-features.md | This configuration is available for both the enrolled (MDM) devices as well as u - In [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Apps** > **App configuration policies** > **Add** > **Managed apps**. - Give the policy a name. - Under the Select Public Apps, choose Microsoft Defender for Endpoint as the target app.- - In Settings page, under the General Configuration Settings, add **WebProtection** as the key and value as **false**, . + - In Settings page, under the General Configuration Settings, add **WebProtection** as the key and value as **false**. - By default, **WebProtection= true**. - Admin needs to make **WebProtection = false** to switch off the web protection. - Defender will send the heartbeat to the Microsoft 365 Defender portal whenever user opens the app. Customers can now enable privacy control for the phish report sent by Microsoft 1. **End User Privacy Controls** These controls help the end user to configure the information shared to their organization. - For Supervised devices, End User controls will not be visible. Admin will decide and controls the settings.- - However, for Unsupervised devices, the control will be displayed under the **Settings-> Privacy** + - However, for Unsupervised devices, the control will be displayed under the **Settings > Privacy** - Users will see a toggle for **Unsafe Site Info**. - This toggle is only visible if Admin has set **DefenderExcludeURLInReport = true** - If enabled by Admin, Users can decide if they want to send the unsafe site info to their Organization or not. Turning the above privacy controls on or off will not impact the device complian ## Optional Permissions -Microsoft Defender for Endpoint on iOS enables **Optional Permissions** in the onboarding flow. Currently the permissions required by MDE are mandatory in the onboarding flow. With this feature, admin can deploy MDE on BYOD devices without enforcing the mandatory **VPN Permission** during onboarding. End Users can onboard the app without the mandatory permissions and can later review these permissions. This feature is currently present only for enrolled devices (MDM). +Microsoft Defender for Endpoint on iOS enables **Optional Permissions** in the onboarding flow. Currently the permissions required by Defender for Endpoint are mandatory in the onboarding flow. With this feature, admins can deploy Defender for Endpoint on BYOD devices without enforcing the mandatory **VPN Permission** during onboarding. End users can onboard the app without the mandatory permissions and can later review these permissions. This feature is currently present only for enrolled devices (MDM). ### Configure Optional Permission Microsoft Defender for Endpoint on iOS enables **Optional Permissions** in the o - Later, User can enable the `Web Protection` from within the App. This will install the VPN configuration on the device. > [!NOTE]->**Optional Permission** is different from **Disable Web Protection**. Optional VPN Permission only helps to skip the permission during onboarding but its available for the end user to later review and enable it. While **Disable Web Protection** allows users to onboard the MDE app without the Web Protection. It cannot be enabled later. +>**Optional Permission** is different from **Disable Web Protection**. Optional VPN Permission only helps to skip the permission during onboarding but its available for the end user to later review and enable it. While **Disable Web Protection** allows users to onboard the Defender for Endpoint app without the Web Protection. It cannot be enabled later. ## Configure compliance policy against jailbroken devices To protect corporate data from being accessed on jailbroken iOS devices, we reco Follow the steps below to create a compliance policy against jailbroken devices. -1. In [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** -> **Compliance policies** -> **Create Policy**. Select "iOS/iPadOS" as platform and click **Create**. +1. In [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Compliance policies** > **Create Policy**. Select "iOS/iPadOS" as platform and click **Create**. :::image type="content" source="images/ios-jb-policy.png" alt-text="The Create Policy tab" lightbox="images/ios-jb-policy.png"::: Defender for Endpoint on iOS enables admins to configure custom indicators on iO > [!NOTE] > Defender for Endpoint on iOS supports creating custom indicators only for IP addresses and URLs/domains. +## Configure vulnerability assessment of apps ++>[!Note] +>Vulnerability Assessment of apps on Microsoft Defender for Endpoint for iOS is now in public preview. The following information relates to the prerelease of the product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. If you are interested to participate in the preview, please share your Tenant name and id with us on **mdatpmobile@microsoft.com**. ++Defender for Endpoint on iOS supports vulnerability assessments of apps only for enrolled (MDM) devices. ++Admins can use the following steps to configure the vulnerability assessment of apps. ++### On a Supervised Device ++1. Ensure the device is configured in the [Supervised mode](ios-install.md#complete-deployment-for-supervised-devices). +1. To enable the feature in [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Endpoint Security** > **Microsoft Defender for Endpoint** > **Enable App sync for iOS/iPadOS devices**. ++ :::image type="content" source="images/tvm-app-sync-toggle.png" alt-text="App sync toggleSup" lightbox="images/tvm-app-sync-toggle.png"::: ++### On an Unsupervised Device ++1. To enable the feature in [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Endpoint Security** > **Microsoft Defender for Endpoint** > **Enable App sync for iOS/iPadOS devices**. ++ :::image type="content" source="images/tvm-app-sync-toggle.png" alt-text="App sync toggle" lightbox="images/tvm-app-sync-toggle.png"::: ++1. To get the list of all the apps including un-managed apps, Enable the toggle **Send full application inventory data on personally owned iOS/iPad OS Devices**. ++ :::image type="content" source="images/tvm-full-app-data.png" alt-text="Full App Data" lightbox="images/tvm-full-app-data.png"::: ++1. Use the following steps to configure the privacy setting. + - Go to **Apps** > **App configuration policies** > **Add** > **Managed devices**. + - Give the policy a name, **Platform** > **iOS/iPadOS**. + - Select **Microsoft Defender for Endpoint** as the target app. + - In Settings page, select Use configuration designer and add **DefenderTVMPrivacyMode** as the key and value type as **String** + - To disable privacy and collect the list of apps installed, enter value as `False` and assign this policy to users. + - By default, this value is set to `True` for unsupervised devices. + - For users with key set as `False`, Defender for Endpoint will send the list of apps installed on the device for vulnerability assessment. + - Click **Next** and assign this profile to targeted devices/users. + - Turning the above privacy controls on or off will not impact the device compliance check or conditional access. +1. Once the config is applied, end-user will need to open the app to **Approve** the privacy setting. + - Privacy approval screen will come only for unsupervised devices. + - Only if end-user approves the privacy, the app information will be sent to the Defender for Endpoint console. ++ :::image type="content" source="images/tvm-user-privacy.png" alt-text="TVM Privacy" lightbox="images/tvm-user-privacy.png"::: ++Once the client versions are deployed to target iOS devices, the processing will start. Vulnerabilities found on those devices will start showing up in the Defender Vulnerability Management dashboard. The processing might take few hours (max 24 hours) to complete. Especially for the entire list of apps to show up in the software inventory. + ## Configure option to send in-app feedback Customers now have the option to configure the ability to send feedback data to Microsoft within the Defender for Endpoint app. Feedback data helps Microsoft improve products and troubleshoot issues. Use the following steps to configure the option to send feedback data to Microso 1. Select **Microsoft Defender for Endpoint** as the target app. 1. In Settings page, select **Use configuration designer** and add **DefenderSendFeedback** as the key and value type as **Boolean**.- + - To remove the ability of end-users to provide feedback, set the value as `false` and assign this policy to users. By default, this value is set to `true`. For US Government customers, the default value is set to 'false'.- + - For users with key set as `true`, there will be an option to send Feedback data to Microsoft within the app (Menu > Help & Feedback > Send Feedback to Microsoft) 1. Click **Next** and assign this profile to targeted devices/users. |
| security | Ios Install | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/ios-install.md | Deploy Defender for Endpoint on iOS via Intune Company Portal. ### Add iOS store app -1. In [Microsoft Endpoint manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Apps** -> **iOS/iPadOS** -> **Add** -> **iOS store app** and click **Select**. +1. In [Microsoft Endpoint manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Apps** > **iOS/iPadOS** > **Add** > **iOS store app** and click **Select**. - > [!div class="mx-imgBorder"] > :::image type="content" source="images/ios-deploy-1.png" alt-text="The Add applications tab in the Microsoft Endpoint Manager Admin Center" lightbox="images/ios-deploy-1.png"::: 1. On the **Add app** page, click on **Search the App Store** and type **Microsoft Defender** in the search bar. In the search results section, click on *Microsoft Defender* and click **Select**. Deploy Defender for Endpoint on iOS via Intune Company Portal. > [!NOTE] > The selected user group should consist of Intune enrolled users. - > [!div class="mx-imgBorder"] - > :::image type="content" source="images/ios-deploy-2.png" alt-text="The Add group tab in the Microsoft Endpoint Manager Admin Center" lightbox="images/ios-deploy-2.png"::: + :::image type="content" source="images/ios-deploy-2.png" alt-text="The Add group tab in the Microsoft Endpoint Manager Admin Center" lightbox="images/ios-deploy-2.png"::: 1. In the *Review + Create* section, verify that all the information entered is correct and then select **Create**. In a few moments, the Defender for Endpoint app should be created successfully, and a notification should show up at the top-right corner of the page. 1. In the app information page that is displayed, in the **Monitor** section, select **Device install status** to verify that the device installation has completed successfully. - > [!div class="mx-imgBorder"] > :::image type="content" source="images/ios-deploy-3.png" alt-text="The Device install status page" lightbox="images/ios-deploy-3.png"::: ## Complete deployment for supervised devices The Microsoft Defender for Endpoint on iOS app has specialized ability on supervised iOS/iPadOS devices, given the increased management capabilities provided by the platform on these types of devices. It can also provide Web Protection **without setting up a local VPN on the device**. This gives end-users a seamless experience while still being protected from phishing and other web-based attacks. +Admins can use the following steps to configure supervised devices. + ### Configure Supervised Mode via Intune -Next, configure the supervised mode for Defender for Endpoint app through an App Configuration policy. +Configure the supervised mode for Defender for Endpoint app through an App configuration policy and Device configuration profile. ++#### App configuration policy > [!NOTE] > This app configuration policy for supervised devices is applicable only to managed devices and should be targeted for ALL managed iOS devices as a best practice. Next, configure the supervised mode for Defender for Endpoint app through an App >  1. In the next screen, select **Use configuration designer** as the format. Specify the following property:- - Configuration Key: issupervised + - Configuration Key: `issupervised` - Value type: String- - Configuration Value: {{issupervised}} + - Configuration Value: `issupervised` > [!div class="mx-imgBorder"] >  Next, configure the supervised mode for Defender for Endpoint app through an App 1. On the **Review + create** page, when you're done, choose **Create**. The new profile is displayed in the list of configuration profiles. -1. Next you must deploy a custom profile on supervised iOS devices. This is for enhanced Anti-phishing capabilities. Follow the steps below: +#### Device configuration profile - - Download the config profile from [https://aka.ms/mdeiosprofilesupervised](https://aka.ms/mdeiosprofilesupervised) - - Navigate to **Devices** -> **iOS/iPadOS** -> **Configuration profiles** -> **Create Profile** + > [!NOTE] + > For devices that run iOS/iPadOS (in Supervised Mode), there is custom **.mobileconfig** profile, called the **ControlFilter** profile available. This profile enables Web Protection **without setting up the local loopback VPN on the device**. This gives end-users a seamless experience while still being protected from phishing and other web-based attacks. ++ Deploy a custom profile on supervised iOS devices. This is for enhanced Anti-phishing capabilities. Follow the steps below: ++1. Download the config profile from [https://aka.ms/mdeiosprofilesupervised](https://aka.ms/mdeiosprofilesupervised) +1. Navigate to **Devices** > **iOS/iPadOS** > **Configuration profiles** > **Create Profile** +1. Select **Profile Type** > **Templates** and **Template name** > **Custom** > [!div class="mx-imgBorder"] > - - - Provide a name of the profile. When prompted to import a Configuration profile file, select the one downloaded from the previous step. - - In the **Assignment** section, select the device group to which you want to apply this profile. As a best practice, this should be applied to all managed iOS devices. Select **Next**. - - On the **Review + create** page, when you're done, choose **Create**. The new profile is displayed in the list of configuration profiles. ++1. Provide a name of the profile. When prompted to import a Configuration profile file, select the one downloaded from the previous step. +1. In the **Assignment** section, select the device group to which you want to apply this profile. As a best practice, this should be applied to all managed iOS devices. Select **Next**. +1. On the **Review + create** page, when you're done, choose **Create**. The new profile is displayed in the list of configuration profiles. ## Auto-Onboarding of VPN profile (Simplified Onboarding) Next, configure the supervised mode for Defender for Endpoint app through an App For unsupervised devices, a VPN is used in order to provide the Web Protection feature. This is not a regular VPN and is a local/self-looping VPN that does not take traffic outside the device. >[!NOTE]->For supervised devices, a VPN is not needed for Web Protection capability and requires admins to setup a configuration profile on supervised devices. To configure for supervised devices, follow the steps in the [Complete deployment for supervised devices](#complete-deployment-for-supervised-devices) section. +>For supervised devices, a VPN is not needed for Web Protection capability and requires admins to set up a configuration profile on supervised devices. To configure for supervised devices, follow the steps in the [Complete deployment for supervised devices](#complete-deployment-for-supervised-devices) section. -Admins can configure auto-setup of VPN profile. This will automatically setup the Defender for Endpoint VPN profile without having the user to do so while onboarding. +Admins can configure auto-setup of VPN profile. This will automatically set up the Defender for Endpoint VPN profile without having the user to do so while onboarding. This step simplifies the onboarding process by setting up the VPN profile. For a zero-touch or silent onboarding experience, see the next section: [Zero-touch onboard](#zero-touch-onboarding-of-microsoft-defender-for-endpoint). -1. In [Microsoft Endpoint manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** -> **Configuration Profiles** -> **Create Profile**. +1. In [Microsoft Endpoint manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Configuration Profiles** > **Create Profile**. 1. Choose **Platform** as **iOS/iPadOS** and **Profile type** as **VPN**. Click **Create**. 1. Type a name for the profile and click **Next**. 1. Select **Custom VPN** for Connection Type and in the **Base VPN** section, enter the following: This step simplifies the onboarding process by setting up the VPN profile. For a ## Zero-touch onboarding of Microsoft Defender for Endpoint -- > [!NOTE] > Zero-touch cannot be configured on iOS devices that are enrolled without user affinity (user-less devices or shared devices). -Admins can configure Microsoft Defender for Endpoint to deploy and activate silently. In this flow, the administrator creates a deployment profile and the user is simply notified of the installation. Defender for Endpoint is automatically installed without the need for the user to open the app. Follow the steps below to setup zero-touch or silent deployment of Defender for Endpoint on enrolled iOS devices: +Admins can configure Microsoft Defender for Endpoint to deploy and activate silently. In this flow, the administrator creates a deployment profile and the user is simply notified of the installation. Defender for Endpoint is automatically installed without the need for the user to open the app. Follow the steps below to set up zero-touch or silent deployment of Defender for Endpoint on enrolled iOS devices: 1. In [Microsoft Endpoint manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Configuration Profiles** > **Create Profile**. 1. Choose **Platform** as **iOS/iPadOS** and **Profile type** as **VPN**. Select **Create**. Admins can configure Microsoft Defender for Endpoint to deploy and activate sile :::image type="content" source="images/ios-deploy-9.png" alt-text="The VPN profile Configuration page" lightbox="images/ios-deploy-9.png"::: - - To mandate that VPN cannot be disabled in users device, Admins can select **Yes** from **Block users from disabling automatic VPN**. By default, it's not configured and users can disable VPN only in the Settings. - - To allow Users to Change the VPN toggle from within the app, add **EnableVPNToggleInApp = TRUE**, in the key-value pairs. By default, users cannot the change the toggle from within the app. + - To mandate that VPN can't be disabled in users device, Admins can select **Yes** from **Block users from disabling automatic VPN**. By default, it's not configured and users can disable VPN only in the Settings. + - To allow Users to Change the VPN toggle from within the app, add **EnableVPNToggleInApp = TRUE**, in the key-value pairs. By default, users can't the change the toggle from within the app. 1. Select **Next** and assign the profile to targeted users. 1. In the *Review + Create* section, verify that all the information entered is correct and then select **Create**. Once the above configuration is done and synced with the device, the following a - Web Protection and other features will be activated. > [!NOTE]- > For supervised devices, although a VPN profile is not required, admins can still setup Zero-touch onboarding by configuring the Defender for Endpoint VPN profile through Intune. The VPN profile will be deployed on the device but will only be present on the device as a pass-through profile and can be deleted after initial onboarding. + > For supervised devices, although a VPN profile is not required, admins still can set up Zero-touch onboarding by configuring the Defender for Endpoint VPN profile through Intune. The VPN profile will be deployed on the device but will only be present on the device as a pass-through profile and can be deleted after initial onboarding. ## Complete onboarding and check status Once the above configuration is done and synced with the device, the following a 3. Upon successful onboarding, the device will start showing up on the Devices list in the Microsoft 365 Defender portal. - > [!div class="mx-imgBorder"] > :::image type="content" source="images/device-inventory-screen.png" alt-text="The Device inventory page" lightbox="images/device-inventory-screen.png"::: ## Configure Microsoft Defender for Endpoint for Supervised Mode Intune allows you to configure the Defender for iOS app through an App Configura 1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Apps** \> **App configuration policies** \> **Add**. Click on **Managed devices**. - > [!div class="mx-imgBorder"] > :::image type="content" source="images/ios-deploy-4.png" alt-text="The Managed devices option" lightbox="images/ios-deploy-4.png"::: 1. In the *Create app configuration policy* page, provide the following information: Intune allows you to configure the Defender for iOS app through an App Configura - Platform: Select iOS/iPadOS - Targeted app: Select **Microsoft Defender for Endpoint** from the list - > [!div class="mx-imgBorder"] > :::image type="content" source="images/ios-deploy-5.png" alt-text="The basic fields for the configuration policy for the application" lightbox="images/ios-deploy-5.png"::: 1. In the next screen, select **Use configuration designer** as the format. Specify the following property:- - Configuration Key: issupervised + - Configuration Key: `issupervised` - Value type: String- - Configuration Value: {{issupervised}} + - Configuration Value: `issupervised` - > [!div class="mx-imgBorder"] > :::image type="content" source="images/ios-deploy-6.png" alt-text="The page from which to choose the format for the settings of the policy configuration" lightbox="images/ios-deploy-6.png"::: 1. Click **Next** to open the **Scope tags** page. Scope tags are optional. Click **Next** to continue. Intune allows you to configure the Defender for iOS app through an App Configura When deploying to user groups, a user must sign in to a device before the policy applies. - Click **Next**. + Select **Next**. 1. On the **Review + create** page, when you're done, choose **Create**. The new profile is displayed in the list of configuration profiles. |
| security | Mtd | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mtd.md | Microsoft Defender for Endpoint on Android and iOS is our **mobile threat defens Microsoft Defender for Endpoint on Android and iOS provides the below key capabilities, For information about the latest features and benefits, read our [announcements](https://aka.ms/mdeblog). -<br> - |Capability|Description| ||| |Web Protection|Anti-phishing, blocking unsafe network connections, and support for custom indicators.| Microsoft Defender for Endpoint on Android and iOS provides the below key capabi |Jailbreak Detection (iOS-only)|Detection of jailbroken devices.| |Microsoft Defender Vulnerability Management (MDVM) |Vulnerability assessment of onboarded mobile devices. Visit this [page](next-gen-threat-and-vuln-mgt.md) to learn more about Microsoft Defender Vulnerability Management in Microsoft Defender for Endpoint. *Note that on iOS only OS vulnerabilities are supported in this preview.*| |Network Protection *(Public Preview)*| Protection against rogue Wi-Fi related threats and rogue certificates; ability to allow list the root CA and private root CA certificates in Intune; establish trust with endpoints.|-|Unified alerting|Alerts from all platforms in the unified M365 security console| -|Conditional Access, Conditional launch|Blocking risky devices from accessing corporate resources. Defender for Endpoint risk signals can also be added to app protection policies (MAM)| -|Privacy Controls. In preview (see note below)|Configure privacy in the threat reports by controlling the data sent by Microsoft Defender for Endpoint. *Note that privacy controls are currently available only for enrolled devices. Controls for unenrolled devices will be added later*| +|Unified alerting|Alerts from all platforms in the unified M365 security console.| +|Conditional Access, Conditional launch|Blocking risky devices from accessing corporate resources. Defender for Endpoint risk signals can also be added to app protection policies (MAM).| +|Privacy Controls|Configure privacy in the threat reports by controlling the data sent by Microsoft Defender for Endpoint. Privacy controls are available for admin and end users. It's there for enrolled and unenrolled devices as well.| |Integration with Microsoft Tunnel|Can integrate with Microsoft Tunnel, a VPN gateway solution to enable security and connectivity in a single app. Available on Android and is now generally available on iOS also.| All these capabilities are available for Microsoft Defender for Endpoint license holders. For more information, see [Licensing requirements](minimum-requirements.md#licensing-requirements). - ## Overview and Deploy Deployment of Microsoft Defender for Endpoint on mobile can be done via Microsoft Endpoint Manager (MEM). Watch this video for a quick overview of MTD capabilities and deployment: The following table summarizes how to deploy Microsoft Defender for Endpoint on |--|-| |Android Enterprise with Intune Unified Endpoint Manager (Microsoft Endpoint Manager)|[Deploy on Android Enterprise enrolled devices](android-intune.md#deploy-on-android-enterprise-enrolled-devices)| |Device Administrator with Intune Unified Endpoint Manager (Microsoft Endpoint Manager)|[Deploy on Device Administrator enrolled devices](android-intune.md#deploy-on-device-administrator-enrolled-devices)|-|Unmanaged BYOD OR devices managed by other Unified Endpoint Managers / Setup app protection policy (MAM)|[Configure Defender risk signals in app protection policy (MAM)](android-configure-mam.md)| +|Unmanaged BYOD OR devices managed by other Unified Endpoint Managers / Set up app protection policy (MAM)|[Configure Defender risk signals in app protection policy (MAM)](android-configure-mam.md)| **iOS** The following table summarizes how to deploy Microsoft Defender for Endpoint on |--|-| |Supervised devices with Intune Unified Endpoint Manager (Microsoft Endpoint Manager)|1. [Deploy as iOS store app](ios-install.md)<br/>2. [Setup Web Protection without VPN for supervised iOS devices](ios-install.md#complete-deployment-for-supervised-devices)| |Unsupervised (BYOD) devices enrolled with Intune UEM (Microsoft Endpoint Manager)|[Deploy as iOS store app](ios-install.md)|-|Unmanaged BYOD OR devices managed by other UEMs / Setup app protection policy (MAM)|[Configure Defender risk signals in app protection policy (MAM)](ios-install-unmanaged.md)| +|Unmanaged BYOD OR devices managed by other UEMs / Set up app protection policy (MAM)|[Configure Defender risk signals in app protection policy (MAM)](ios-install-unmanaged.md)| ### End-user onboarding |
| security | Use Powershell Cmdlets Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/use-powershell-cmdlets-microsoft-defender-antivirus.md | ms.localizationpriority: medium Previously updated : 10/18/2020 Last updated : 09/06/2022 -You can use PowerShell to perform various functions in Windows Defender. Similar to the command prompt or command line, PowerShell is a task-based command-line shell and scripting language designed especially for system administration. You can read more about it at the [PowerShell hub on MSDN](/previous-versions/msdn10/mt173057(v=msdn.10)). +You can use PowerShell to perform various functions in Windows Defender. Similar to the command prompt or command line, PowerShell is a task-based command-line shell and scripting language designed especially for system administration. You can read more about it in the [PowerShell documentation](/powershell/scripting/overview). For a list of the cmdlets and their functions and available parameters, see the [Defender Antivirus cmdlets](/powershell/module/defender) topic. PowerShell cmdlets are most useful in Windows Server environments that don't rely on a graphical user interface (GUI) to configure software. > [!NOTE]-> PowerShell cmdlets should not be used as a replacement for a full network policy management infrastructure, such as [Microsoft Endpoint Configuration Manager](/configmgr), [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), or [Microsoft Defender Antivirus Group Policy ADMX templates](https://www.microsoft.com/download/101445). +> PowerShell cmdlets should not be used as a replacement for a full network policy management infrastructure, such as [Microsoft Endpoint Configuration Manager](/configmgr), [Group Policy Management Console](use-group-policy-microsoft-defender-antivirus.md), or [Microsoft Defender Antivirus Group Policy ADMX templates](https://www.microsoft.com/download/101445). Changes made with PowerShell will affect local settings on the endpoint where the changes are deployed or made. This means that deployments of policy with Group Policy, Microsoft Endpoint Configuration Manager, or Microsoft Intune can overwrite changes made with PowerShell. |
| security | Whats New In Microsoft Defender Endpoint | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint.md | ms.pagetype: security ms.localizationpriority: medium Previously updated : 09/06/2022 Last updated : 09/12/2022 audience: ITPro - - m365-security-compliance +- m365-security-compliance For more information on Microsoft Defender for Endpoint on other operating syste ## September 2022 - [Device health reporting is now generally available](machine-reports.md). <br/>The device health report provides high-level information about the health and security of your endpoints. The report includes trending information showing the sensor health state, antivirus status, OS platforms, Windows 10 versions, and Microsoft Defender Antivirus update versions.+- [Troubleshooting mode](enable-troubleshooting-mode.md) is now available for Windows Server 2012 R2 and 2016 machines running the modern, unified solution. During troubleshooting mode, use `Set-MPPreference -DisableTamperProtection $true` to temporarily disable tamper protection on your device and make your necessary configuration changes. Before you use troubleshooting mode, make sure all of the following components are up to date: + - Sense version 10.8049.22439.1084 (KB5005292) or later + - Microsoft Defender Antivirus - Platform: 4.18.2207.7 (KB4052623) or later + - Microsoft Defender Antivirus - Engine: 1.1.19500.2 (KB2267602) or later ## August 2022 |
| security | Admin Submission | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/admin-submission.md | After a few moments, an allow entry will appear on the **Files** tab on the **Te - **Select the submission type**: Verify the value **URL** is selected. - - **URL**: Enter the full URL (for example, `https://www.fabrikam.com/marketing.html`), and then select it in the box that appears. + - **URL**: Enter the full URL (for example, `https://www.fabrikam.com/marketing.html`), and then select it in the box that appears. You can also provide a top level domain (for example, `https://www.fabrikam.com/*`), and then select it in the box that appears. + - **Select a reason for submitting to Microsoft**: Select **Should not have been blocked (False positive)**, and then configure the following settings: |