| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Ownerless Groups Teams | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/create-groups/ownerless-groups-teams.md | Notifications are sent weekly starting within 24 hours of policy creation. Recip Up to two group members per group can accept the invitation to become an owner. If no group members accept, an administrator will have to [assign a group owner](/admin/create-groups/add-or-remove-members-from-groups). +## Related topics +[Ownerless group FAQ](/exchange/troubleshoot/groups-and-distribution-lists/ownerless-group-policy) |
| admin | Whats New In Preview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/whats-new-in-preview.md | And if you'd like to know what's new with other Microsoft cloud - [Office updates](/OfficeUpdates/) - [How to check Windows release health](/windows/deployment/update/check-release-health) +## August 2022 ++### Date filter in the Net Promoter Score (NPS) survey insights dashboard ++Based on your feedback, we are introducing a new function in the NPS survey insights dashboard that allows Admins like you to filter the Net Promoter Score (NPS) data and insights per date, so that you can access details based on your date range preference. ++With this change, you will be able to look at the NPS survey insights based on the following date ranges: ++- Past 30 days +- Past 90 days +- Past 180 days ++To access, go to **Health** > **Product feedback** > **NPS survey insights tab**. +++Learn more about [NPS survey insights](/microsoft-365/admin/manage/manage-feedback-product-insights). ++For questions or feedback related to NPS survey insights, contact us at Prosight@microsoft.com. +++## July 2022 ++### Multi-tenant billing relationships ++You can now create multi-tenant billing relationships with other tenants. A multi-tenant billing relationship lets you securely share your organization's billing account with other tenants, while maintaining control over your billing data. ++This feature is available to organizational account customers with a Microsoft Customer Agreement. ++For more information, see [Manage billing across multiple tenants in the Microsoft 365 admin center](../commerce/billing-and-payments/manage-multi-tenant-billing.md). + ## May 2022 ### Role based access controls (RBAC) |
| compliance | Data Lifecycle Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/data-lifecycle-management.md | ms.localizationpriority: high - M365-security-compliance - tier1+- highpri - SPO_Content description: Learn how Microsoft Purview Data Lifecycle Management helps you keep what you need and delete what you don't. |
| compliance | Encryption Azure Ad Configuration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/encryption-azure-ad-configuration.md | However, the automatic guest account is not created immediately in this scenario ## Next steps -For configurations you might need to make for network infrastructure services, see [Firewalls and network infrastructure](/azure/information-protection/requirements#firewalls-and-network-infrastructure). +For addition configurations you might need to make, see [Restrict access to a tenant](/azure/active-directory/manage-apps/tenant-restrictions). Specific to network infrastructure configuration for the Azure Information Protection service, see [Firewalls and network infrastructure](/azure/information-protection/requirements#firewalls-and-network-infrastructure). If you use [sensitivity labels](sensitivity-labels.md) to encrypt documents and emails, you might be interested in [Support for external users and labeled content](sensitivity-labels-office-apps.md#support-for-external-users-and-labeled-content) to understand which label settings apply across tenants. For configuration guidance for the label encryption settings, see [Restrict access to content by using sensitivity labels to apply encryption](encryption-sensitivity-labels.md). |
| compliance | Get Started With Data Lifecycle Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/get-started-with-data-lifecycle-management.md | ms.localizationpriority: high - M365-security-compliance - tier1+- highpri - SPO_Content search.appverid: |
| compliance | Get Started With Records Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/get-started-with-records-management.md | ms.localizationpriority: high - M365-security-compliance - tier1+- highpri - SPO_Content search.appverid: |
| compliance | Get Started With Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/get-started-with-sensitivity-labels.md | ms.localizationpriority: high - M365-security-compliance - tier1+- highpri - SPO_Content - m365solution-mip search.appverid: |
| compliance | Mip Easy Trials | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/mip-easy-trials.md | Last updated audience: Admin ++- M365-security-compliance +- tier1 ms.localizationpriority: high description: Learn about the default labels and policies for Microsoft Purview Information Protection to classify and protect sensitive content. |
| compliance | Records Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/records-management.md | ms.localizationpriority: high - M365-security-compliance - tier1+- highpri search.appverid: - MOE150 - MET150 |
| compliance | Retention | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/retention.md | ms.localizationpriority: high - M365-security-compliance - tier1+- highpri - SPO_Content search.appverid: - MOE150 |
| compliance | Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels.md | +- tier1 +- highpri - SPO_Content - m365solution-mip search.appverid: |
| security | Attack Surface Reduction Rules Deployment Operationalize | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-operationalize.md | ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security + ms.localizationpriority: medium audience: ITPro |
| security | Attack Surface Reduction Rules Deployment Plan | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-plan.md | ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security + ms.localizationpriority: medium audience: ITPro |
| security | Configure Proxy Internet | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-proxy-internet.md | audience: ITPro - m365-security-compliance - m365-initiative-defender-endpoint-+ The static proxy is configurable through group policy (GP), both the settings un | Configure connected user experiences and telemetry | `HKLM\Software\Policies\Microsoft\Windows\DataCollection` | `TelemetryProxyServer` | ```servername:port or ip:port``` <br> <br> For example: ```10.0.0.6:8080``` (REG_SZ) | > [!NOTE]-> If you are using 'TelemetryProxyServer' setting on devices that are otherwise **completely offline**, then it is recommended to add the additional registry setting `PreferStaticProxyForHttpRequest` with a value of `1`.<br> +> If you are using 'TelemetryProxyServer' setting on devices that are otherwise **completely offline**, meaning the operating system is unable to connect for the online certificate revocation list or Windows Update, then it is recommended to add the additional registry setting `PreferStaticProxyForHttpRequest` with a value of `1`.<br> > Parent registry path location for "PreferStaticProxyForHttpRequest" is "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection"<br> > The following command can be used to insert the registry value in the correct location:<br> > ```reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /v PreferStaticProxyForHttpRequest /t REG_DWORD /d 1 /f```<br> |
| security | Configure Server Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-server-endpoints.md | ms.pagetype: security ms.localizationpriority: medium Previously updated : 08/10/2022 Last updated : 09/22/2022 audience: ITPro - M365-security-compliance - m365-initiative-defender-endpoint-+ -This topic describes how to onboard specific Windows servers to Microsoft Defender for Endpoint. +This article describes how to onboard specific Windows servers to Microsoft Defender for Endpoint. For guidance on how to download and use Windows Security Baselines for Windows servers, see [Windows Security Baselines](/windows/device-security/windows-security-baselines). You'll need to complete the following general steps to successfully onboard serv :::image type="content" source="images/server-onboarding-tools-methods.png" alt-text="An illustration of onboarding flow for Windows Servers and Windows 10 devices" lightbox="images/server-onboarding-tools-methods.png"::: - >[!NOTE]->Windows Server Hyper-V is not supported. ---## Integration with Microsoft Defender for Servers +> Windows Hyper-V Server editions are not supported. -Microsoft Defender for Endpoint integrates seamlessly with Microsoft Defender for Servers. You can onboard servers automatically, have servers monitored by Microsoft Defender for Cloud appear in Defender for Endpoint, and conduct detailed investigations as a Microsoft Defender for Cloud customer. +**Integration with Microsoft Defender for Servers**: -For more information, see [Integration with Microsoft Defender for Cloud](azure-server-integration.md). +Microsoft Defender for Endpoint integrates seamlessly with Microsoft Defender for Servers. You can onboard servers automatically, have servers monitored by Microsoft Defender for Cloud appear in Defender for Endpoint, and conduct detailed investigations as a Microsoft Defender for Cloud customer. For more information please go to [Protect your endpoints with Defender for Cloud's integrated EDR solution: Microsoft Defender for Endpoint](/azure/defender-for-cloud/integration-defender-for-endpoint?tabs=windows) > [!NOTE]-> For Windows Server 2012 R2 and 2016 running the modern unified solution, you can either manually install/upgrade the new solution on these machines, or use the integration to automatically deploy or upgrade servers covered by your respective Microsoft Defender for Server plan. More information about making the switch at [Protect your endpoints with Defender for Cloud's integrated EDR solution: Microsoft Defender for Endpoint](/azure/defender-for-cloud/integration-defender-for-endpoint?tabs=windows). +> For Windows Server 2012 R2 and 2016, you can either manually install/upgrade the modern, unified solution on these machines, or use the integration to automatically deploy or upgrade servers covered by your respective Microsoft Defender for Server plan. More information about making the switch at [Protect your endpoints with Defender for Cloud's integrated EDR solution: Microsoft Defender for Endpoint](/azure/defender-for-cloud/integration-defender-for-endpoint?tabs=windows#enable-the-integration). > - When you use Microsoft Defender for Cloud to monitor servers, a Defender for Endpoint tenant is automatically created (in the US for US users, in the EU for European users, and in the UK for UK users). Data collected by Defender for Endpoint is stored in the geo-location of the tenant as identified during provisioning. > - If you use Defender for Endpoint before using Microsoft Defender for Cloud, your data will be stored in the location you specified when you created your tenant even if you integrate with Microsoft Defender for Cloud at a later time. > - Once configured, you cannot change the location where your data is stored. If you need to move your data to another location, you need to contact Microsoft Support to reset the tenant.-> - The integration between Microsoft Defender for servers and Microsoft Defender for Endpoint has been expanded to support Windows Server 2022, [Windows Server 2019, and Windows Virtual Desktop (WVD)](/azure/security-center/release-notes#microsoft-defender-for-endpoint-integration-with-azure-defender-now-supports-windows-server-2019-and-windows-10-virtual-desktop-wvd-in-preview). > - Server endpoint monitoring utilizing this integration has been disabled for Office 365 GCC customers.+> - Linux servers onboarded through Microsoft Defender for Cloud will have their initial configuration set to run Defender Antivirus in [passive mode](/defender-endpoint/microsoft-defender-antivirus-compatibility#microsoft-defender-antivirus-and-non-microsoft-antivirusantimalware-solutions). **Windows Server 2012 R2 and Windows Server 2016**: Data collected by Defender for Endpoint is stored in the geo-location of the ten >[!IMPORTANT] >In order to be eligible to purchase Microsoft Defender for Endpoint Server SKU, you must have already purchased a combined minimum of any of the following, Windows E5/A5, Microsoft 365 E5/A5 or Microsoft 365 E5 Security subscription licenses. For more information on licensing, see the [Product Terms](https://www.microsoft.com/licensing/terms/productoffering/MicrosoftDefenderforEndpointServer/all). -### New Windows Server 2012 R2 and 2016 functionality in the modern unified solution +## Windows Server 2012 R2 and Windows Server 2016 -The previous implementation of onboarding Windows Server 2012 R2 and Windows Server 2016 required the use of Microsoft Monitoring Agent (MMA). +### New Windows Server 2012 R2 and 2016 functionality in the modern unified solution -The new unified solution package makes it easier to onboard servers by removing dependencies and installation steps. In addition, this unified solution package comes with the following major improvements: +The previous implementation (before April of 2022) of onboarding Windows Server 2012 R2 and Windows Server 2016 required the use of Microsoft Monitoring Agent (MMA). -- [Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows) with [Next-generation protection](/microsoft-365/security/defender-endpoint/next-generation-protection) for Windows Server 2012 R2-- [Attack Surface Reduction (ASR) rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules)-- [Network Protection](/microsoft-365/security/defender-endpoint/network-protection)-- [Controlled Folder Access](/microsoft-365/security/defender-endpoint/controlled-folders)-- [Potentially Unwanted Application (PUA) blocking](/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus)-- [Improved detection capabilities](/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response)-- [Expanded response capabilities](/microsoft-365/security/defender-endpoint/respond-machine-alerts) on devices and [files](/microsoft-365/security/defender-endpoint/respond-file-alerts)-- [EDR in Block Mode](/microsoft-365/security/defender-endpoint/edr-in-block-mode)-- [Live Response](/microsoft-365/security/defender-endpoint/live-response)-- [Automated Investigation and Response (AIR)](/microsoft-365/security/defender-endpoint/automated-investigations)-- [Tamper Protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection)+The new unified solution package makes it easier to onboard servers by removing dependencies and installation steps. It also provides a much expanded feature set. For more information, please refer to [Defending Windows Server 2012 R2 and 2016](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/defending-windows-server-2012-r2-and-2016/ba-p/2783292). Depending on the server that you're onboarding, the unified solution installs Microsoft Defender Antivirus and/or the EDR sensor. The following table indicates what component is installed and what is built in by default. Depending on the server that you're onboarding, the unified solution installs Mi If you've previously onboarded your servers using MMA, follow the guidance provided in [Server migration](server-migration.md) to migrate to the new solution. -#### Known issues and limitations in the new, unified solution package for Windows Server 2012 R2 and 2016 --The following specifics apply to the new unified solution package for Windows Server 2012 R2 and 2016: --- An operating system update can introduce an installation issue on machines with slower disks due to a timeout with service installation. Installation fails with the message "Could not find c:\program files\windows defender\mpasdesc.dll, - 310 WinDefend". Please use the latest installation package, as well as the latest [install.ps1](https://github.com/microsoft/mdefordownlevelserver) script to assist in clearing the failed installation if required.-- Ensure connectivity requirements as specified in [Enable access to Microsoft Defender for Endpoint service URLs in the proxy server](/microsoft-365/security/defender-endpoint/configure-proxy-internet?enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server) are met. They're equivalent to those requirements for Windows Server 2019.-- We've identified an issue with Windows Server 2012 R2 connectivity to cloud when static TelemetryProxyServer is used **and** the certificate revocation list (CRL) URLs aren't reachable from the SYSTEM account context. The immediate mitigation is to either use an alternative proxy option ("system-wide") that provides such connectivity, or configure the same proxy via the WinInet setting on the SYSTEM account context.-Alternatively, use the instructions provided at [Workaround for a known issue with TelemetryProxyServer on disconnected machines](#workaround-for-a-known-issue-with-telemetryproxyserver-on-disconnected-machines) to install a certificate as a workaround. -- Previously, the use of the Microsoft Monitoring Agent (MMA) on Windows Server 2016 and below allowed for the OMS / Log Analytics gateway to provide connectivity to Defender cloud services. The new solution, like Microsoft Defender for Endpoint on Windows Server 2019, Windows Server 2022, and Windows 10, doesn't support this gateway.-- On Windows Server 2016, verify that Microsoft Defender Antivirus is installed, is active and up to date. You can download and install the latest platform version using Windows Update. Alternatively, download the update package manually from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4052623) or from [MMPC](https://go.microsoft.com/fwlink/?linkid=870379&arch=x64).-- On Windows Server 2012 R2, there's no user interface for Microsoft Defender Antivirus. In addition, the user interface on Windows Server 2016 only allows for basic operations. To perform operations on a device locally, refer to [Manage Microsoft Defender for Endpoint with PowerShell, WMI, and MPCmdRun.exe](/microsoft-365/security/defender-endpoint/manage-mde-post-migration-other-tools). As a result, features that specifically rely on user interaction, such as where the user is prompted to make a decision or perform a specific task, may not work as expected. It's recommended to disable or not enable the user interface nor require user interaction on any managed server as it may impact protection capability.-- Not all Attack Surface Reduction rules are available on all operating systems. See [Attack Surface Reduction (ASR) rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules).-- To enable [Network Protection](/microsoft-365/security/defender-endpoint/network-protection), more configurations are required:- - `Set-MpPreference -EnableNetworkProtection Enabled` - - `Set-MpPreference -AllowNetworkProtectionOnWinServer 1` - - `Set-MpPreference -AllowNetworkProtectionDownLevel 1` - - `Set-MpPreference -AllowDatagramProcessingOnWinServer 1` -- In addition, on machines with a high volume of network traffic, performance testing in your environment is highly recommended before enabling this capability broadly. You may need to account for extra resource consumption. -- On Windows Server 2012 R2, Network Events may not populate in the timeline. This issue requires a Windows Update released as part of the [October 12, 2021 monthly rollup (KB5006714)](https://support.microsoft.com/topic/october-12-2021-kb5006714-monthly-rollup-4dc4a2cd-677c-477b-8079-dcfef2bda09e).-- Operating system upgrades aren't supported. Offboard then uninstall before upgrading.-- Automatic exclusions for **server roles** aren't supported on Windows Server 2012 R2; however, built-in exclusions for operating system files are. For more information about adding exclusions, see [Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/topic/virus-scanning-recommendations-for-enterprise-computers-that-are-running-currently-supported-versions-of-windows-kb822158-c067a732-f24a-9079-d240-3733e39b40bc).-- On machines that have been upgraded from the previous, MMA-based solution and the EDR sensor is a (preview) version older than 10.8047.22439.1056, uninstalling and reverting back to the MMA-based solution may lead to crashes. If you are on such a preview version, update using KB5005292.-- To deploy and onboard the new solution using Microsoft Endpoint Manager, this process currently requires creating a package. For more information on how to deploy programs and scripts in Configuration Manager, see [Packages and programs in Configuration Manager](/configmgr/apps/deploy-use/packages-and-programs). MECM 2107 with the hotfix rollup or later is required to support policy configuration management using the Endpoint Protection node. Migrating servers from Microsoft Monitoring Agent to the unified solution requires Microsoft Endpoint Configuration Manager older than 2207. For more information, see [Migrating servers from Microsoft Monitoring Agent to the unified solution](application-deployment-via-mecm.md).--## Workaround for a known issue with TelemetryProxyServer on disconnected machines --Problem description: -When using the TelemetryProxyServer setting to specify a proxy to be used by the EDR component of Microsoft Defender for Endpoint, on machines that have no other way to access the Certificate Revocation List (CRL) URL, a missing intermediate certificate will cause the EDR sensor to not successfully connect to the cloud service. --Affected scenario: --Microsoft Defender for Endpoint with Sense version number 10.8048.22439.1065 or earlier preview versions running on Windows Server 2012 R2--Using the TelemetryProxyServer proxy configuration; other methods aren't affected--Workaround: -1. Ensure the machine is running Sense version 10.8048.22439.1065 or higher by either installing using the latest package available from the onboarding page, or by applying KB5005292. -2. Download and unzip the certificate from https://github.com/microsoft/mdefordownlevelserver/blob/main/InterCA.zip -3. Import the certificate to the Local Computer trusted "Intermediate Certification Authorities" store. -You can use the PowerShell command: -Import-Certificate -FilePath .\InterCA.cer -CertStoreLocation Cert:\LocalMachine\Ca --## Integration with Microsoft Defender for Cloud --Microsoft Defender for Endpoint integrates seamlessly with Microsoft Defender for Cloud. You can onboard servers automatically, have servers monitored by Microsoft Defender for Cloud appear in Defender for Endpoint, and conduct detailed investigations as a Microsoft Defender for Cloud customer. --For more information, see [Integration with Microsoft Defender for Cloud](azure-server-integration.md). Linux servers onboarded through Microsoft Defender for Cloud will have their initial configuration set to run Defender Antivirus in [passive mode](/defender-endpoint/microsoft-defender-antivirus-compatibility#microsoft-defender-antivirus-and-non-microsoft-antivirusantimalware-solutions). --> [!NOTE] -> - The integration between Microsoft Defender for servers and Microsoft Defender for Endpoint has been expanded to support Windows Server 2022, [Windows Server 2019, and Windows Virtual Desktop (WVD)](/azure/security-center/release-notes#microsoft-defender-for-endpoint-integration-with-azure-defender-now-supports-windows-server-2019-and-windows-10-virtual-desktop-wvd-in-preview). -> - Server endpoint monitoring utilizing this integration has been disabled for Office 365 GCC customers. --## Windows Server 2012 R2 and Windows Server 2016 +> [!IMPORTANT] +> Before proceeding with onboarding, see the section [Known issues and limitations in the new, unified solution package for Windows Server 2012 R2 and 2016](#known-issues-and-limitations-in-the-new-unified-solution-package-for-windows-server-2012-r2-and-2016). ### Prerequisites #### Prerequisites for Windows Server 2012 R2 -If you've fully updated your machines with the latest [monthly rollup](https://support.microsoft.com/topic/october-12-2021-kb5006714-monthly-rollup-4dc4a2cd-677c-477b-8079-dcfef2bda09e) package, there are **no** other prerequisites. +If you've fully updated your machines with the latest [monthly rollup](https://support.microsoft.com/topic/windows-8-1-and-windows-server-2012-r2-update-history-47d81dd2-6804-b6ae-4112-20089467c7a6) package, there are **no other prerequisites, and the following requirements will already be filled. This is the recommended path. -The installer package will check if the following components have already been installed via an update: +The installer package will check if the following components have already been installed via an update to assess if minimum requirements have been met for a successful installation: - [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/help/3080149/update-for-customer-experience-and-diagnostic-telemetry) - [Update for Universal C Runtime in Windows](https://support.microsoft.com/topic/update-for-universal-c-runtime-in-windows-c0514201-7fe6-95a3-b0a5-287930f3560c)+- [Security Update for Windows Server 2012 R2 (KB3045999)](https://support.microsoft.com/en-us/topic/ms15-038-description-of-the-security-update-for-windows-april-14-2015-99265f07-6926-d6d2-5203-3b32b214a9c3) ++> [!NOTE] +> After installation, Network Events may not populate in the timeline. This issue requires a Windows Update released as part of the [October 12, 2021 monthly rollup (KB5006714)](https://support.microsoft.com/topic/october-12-2021-kb5006714-monthly-rollup-4dc4a2cd-677c-477b-8079-dcfef2bda09e). #### Prerequisites for Windows Server 2016 -- The Servicing Stack Update (SSU) from September 14, 2021 or later must be installed.-- The Latest Cumulative Update (LCU) from September 20, 2018 or later must be installed. It's recommended to install the latest available SSU and LCU on the server-- Enable the Microsoft Defender Antivirus feature and ensure it's up to date. For more information on enabling Defender Antivirus on Windows Server, see [Re-enable Defender Antivirus on Windows Server if it was disabled](enable-update-mdav-to-latest-ws.md#re-enable-microsoft-defender-antivirus-on-windows-server-if-it-was-disabled) and [Re-enable Defender Antivirus on Windows Server if it was uninstalled](enable-update-mdav-to-latest-ws.md#re-enable-microsoft-defender-antivirus-on-windows-server-if-it-was-uninstalled).-- Download and install the latest platform version using Windows Update. Alternatively, download the update package manually from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4052623) or from [MMPC](https://go.microsoft.com/fwlink/?linkid=870379&arch=x64).+If you've updated your machines to support running the latest version of the Windows Defender Antivirus feature, there are **no** other prerequisites. For more information on enabling Defender Antivirus on Windows Server, see [Re-enable Defender Antivirus on Windows Server if it was disabled](enable-update-mdav-to-latest-ws.md#re-enable-microsoft-defender-antivirus-on-windows-server-if-it-was-disabled) and [Re-enable Defender Antivirus on Windows Server if it was uninstalled](enable-update-mdav-to-latest-ws.md#re-enable-microsoft-defender-antivirus-on-windows-server-if-it-was-uninstalled). ++- Enable the Microsoft Defender Antivirus feature and ensure it's up to date. +- Download and install the latest platform version using Windows Update or WSUS. Alternatively, download the update package manually from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4052623) or from [MMPC](https://go.microsoft.com/fwlink/?linkid=870379&arch=x64). #### Prerequisites for running with third-party security solutions If you intend to use a third-party anti-malware solution, you'll need to run Mic > [!NOTE] > If you're installing Microsoft Defender for Endpoint on Servers with McAfee Endpoint Security (ENS) or VirusScan Enterprise (VSE), the version of the McAfee platform may need to be updated to ensure Microsoft Defender Antivirus is not removed or disabled. For more information including the specific version numbers required, see, [McAfee Knowledge Center article](https://kcm.trellix.com/corporate/index?page=content&id=KB88214). -#### Update package for Microsoft Defender for Endpoint on Windows Server 2012 R2 and 2016 +#### Update packages for Microsoft Defender for Endpoint on Windows Server 2012 R2 and 2016 To receive regular product improvements and fixes for the EDR Sensor component, ensure Windows Update [KB5005292](https://go.microsoft.com/fwlink/?linkid=2168277) gets applied or approved. In addition, to keep protection components updated, see [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus#monthly-platform-and-engine-versions). You'll need to download both the **installation** and **onboarding** packages fr > [!NOTE] > The installation package is updated monthly. Be sure to download the latest package before usage.+> To update after installation, you do not have to run the installer package again. If you do, the installer will ask you to offboard first as that is a requirement for uninstallation. See [Update packages for Microsoft Defender for Endpoint on Windows Server 2012 R2 and 2016](#update-packages-for-microsoft-defender-for-endpoint-on-windows-server-2012-r2-and-2016). > [!div class="mx-imgBorder"] >  The **onboarding package** contains the following files: - `OptionalParamsPolicy` - contains the setting that enables sample collection - `WindowsDefenderATPOnboardingScript.cmd` - contains the onboarding script -Use the following steps to download the packages: +Follow these steps to download the packages: 1. In Microsoft 365 Defender, go to **Settings > Device Management > Onboarding**. Support for Windows Server provides deeper insight into server activities, cover ##### Install Microsoft Defender for Endpoint using a script -You can use the [installer script](server-migration.md#installer-script) to help automate installation, uninstallation, and onboarding. +You can use the [installer helper script](server-migration.md#installer-script) to help automate installation, uninstallation, and onboarding. > [!NOTE] > The installation script is signed. Any modifications to the script will invalidate the signature. When you download the script from GitHub, the recommended approach to avoid inadvertent modification is to download the source files as a zip archive then extract it to obtain the install.ps1 file (on the main Code page, click the Code dropdown menu and select "Download ZIP"). This script can be used in various scenarios, including those scenarios describe ##### Apply the Microsoft Defender for Endpoint installation and onboarding packages using Group policy -1. Create a group policy: <br> Open the [Group Policy Management Console](/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11) (GPMC), right-click **Group Policy Objects** you want to configure and click **New**. Enter the name of the new GPO in the dialogue box that is displayed and click **OK**. +1. Create a group policy: <br> Open the [Group Policy Management Console](/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11) (GPMC), right-click **Group Policy Objects** you want to configure and select **New**. Enter the name of the new GPO in the dialogue box that is displayed and select **OK**. -2. Open the [Group Policy Management Console](/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. +2. Open the [Group Policy Management Console](/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11) (GPMC), right-click the Group Policy Object (GPO) you want to configure and select **Edit**. 3. In the **Group Policy Management Editor**, go to **Computer configuration**, then **Preferences**, and then **Control panel settings**. 4. Right-click **Scheduled tasks**, point to **New**, and then click **Immediate Task (At least Windows 7)**. -5. In the **Task** window that opens, go to the **General** tab. Under **Security options** click **Change User or Group** and type SYSTEM and then click **Check Names** then **OK**. NT AUTHORITY\SYSTEM appears as the user account the task will run as. +5. In the **Task** window that opens, go to the **General** tab. Under **Security options** select **Change User or Group** and type SYSTEM and then select **Check Names** then **OK**. NT AUTHORITY\SYSTEM appears as the user account the task will run as. 6. Select **Run whether user is logged on or not** and check the **Run with highest privileges** check box. This script can be used in various scenarios, including those scenarios describe 9. Select **OK** and close any open GPMC windows. -10. To link the GPO to an Organization Unit (OU), right-click and select **Link an existing GPO**. In the dialogue box that is displayed, select the Group Policy Object that you wish to link. Click **OK**. +10. To link the GPO to an Organization Unit (OU), right-click and select **Link an existing GPO**. In the dialogue box that is displayed, select the Group Policy Object that you wish to link. Select **OK**. For more configuration settings, see [Configure sample collection settings](configure-endpoints-gp.md#configure-sample-collection-settings) and [Other recommended configuration settings](configure-endpoints-gp.md#other-recommended-configuration-settings). The following steps are only applicable if you're using a third-party anti-malwa > [!IMPORTANT] >-> - The Onboarding package for Windows Server 2012 R2, 2016, 2019 and 2022 through Microsoft Endpoint Manager currently ships as a script. For more information on how to deploy programs and scripts in Configuration Manager, see [Packages and programs in Configuration Manager](/configmgr/apps/deploy-use/packages-and-programs). > - A local script is suitable for a proof of concept but should not be used for production deployment. For a production deployment, we recommend using Group Policy, or Microsoft Endpoint Configuration Manager. +#### Known issues and limitations in the new, unified solution package for Windows Server 2012 R2 and 2016 ++Always download the latest installer package before performing a new installation. After installation, ensure to regularly update using component updates described in the section [Update packages for Microsoft Defender for Endpoint on Windows Server 2012 R2 and 2016](#update-packages-for-microsoft-defender-for-endpoint-on-windows-server-2012-r2-and-2016). The following specifics apply to the new unified solution package for Windows Server 2012 R2 and 2016: ++- An operating system update can introduce an installation issue on machines with slower disks due to a timeout with service installation. Installation fails with the message "Could not find c:\program files\windows defender\mpasdesc.dll, - 310 WinDefend". Use the latest installation package, and the latest [install.ps1](https://github.com/microsoft/mdefordownlevelserver) script to help clear the failed installation if necessary. +- Ensure connectivity requirements as specified in [Enable access to Microsoft Defender for Endpoint service URLs in the proxy server](/microsoft-365/security/defender-endpoint/configure-proxy-internet?enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server) are met. They're equivalent to those requirements for Windows Server 2019. +- We've identified an issue with Windows Server 2012 R2 connectivity to cloud when static TelemetryProxyServer is used **and** the certificate revocation list (CRL) URLs aren't reachable from the SYSTEM account context. The immediate mitigation is to either use an alternative proxy option ("system-wide") that provides such connectivity, or configure the same proxy via the WinInet setting on the SYSTEM account context. +Alternatively, use the instructions provided at [Workaround for a known issue with TelemetryProxyServer on disconnected machines](#workaround-for-a-known-issue-with-telemetryproxyserver-on-disconnected-machines) to install a certificate as a workaround. +- Previously, the use of the Microsoft Monitoring Agent (MMA) on Windows Server 2016 and below allowed for the OMS / Log Analytics gateway to provide connectivity to Defender cloud services. The new solution, like Microsoft Defender for Endpoint on Windows Server 2019, Windows Server 2022, and Windows 10, doesn't support this gateway. +- On Windows Server 2016, verify that Microsoft Defender Antivirus is installed, is active and up to date. You can download and install the latest platform version using Windows Update. Alternatively, download the update package manually from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4052623) or from [MMPC](https://go.microsoft.com/fwlink/?linkid=870379&arch=x64). +- On Windows Server 2012 R2, there's no user interface for Microsoft Defender Antivirus. In addition, the user interface on Windows Server 2016 only allows for basic operations. To perform operations on a device locally, refer to [Manage Microsoft Defender for Endpoint with PowerShell, WMI, and MPCmdRun.exe](/microsoft-365/security/defender-endpoint/manage-mde-post-migration-other-tools). As a result, features that specifically rely on user interaction, such as where the user is prompted to make a decision or perform a specific task, may not work as expected. It's recommended to disable or not enable the user interface nor require user interaction on any managed server as it may impact protection capability. +- Not all Attack Surface Reduction rules are available on all operating systems. See [Attack Surface Reduction (ASR) rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules). +- To enable [Network Protection](/microsoft-365/security/defender-endpoint/network-protection), more configurations are required: + - `Set-MpPreference -EnableNetworkProtection Enabled` + - `Set-MpPreference -AllowNetworkProtectionOnWinServer 1` + - `Set-MpPreference -AllowNetworkProtectionDownLevel 1` + - `Set-MpPreference -AllowDatagramProcessingOnWinServer 1` ++ In addition, on machines with a high volume of network traffic, performance testing in your environment is highly recommended before enabling this capability broadly. You may need to account for extra resource consumption. +- Operating system upgrades aren't supported. Offboard then uninstall before upgrading. +- Automatic exclusions for **server roles** aren't supported on Windows Server 2012 R2; however, built-in exclusions for operating system files are. For more information about adding exclusions, see [Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/topic/virus-scanning-recommendations-for-enterprise-computers-that-are-running-currently-supported-versions-of-windows-kb822158-c067a732-f24a-9079-d240-3733e39b40bc). +- On machines that have been upgraded from the previous, MMA-based solution and the EDR sensor is a (preview) version older than 10.8047.22439.1056, uninstalling and reverting back to the MMA-based solution may lead to crashes. If you are on such a preview version, update using KB5005292. +- To deploy and onboard the new solution using Microsoft Endpoint Configuration Manager (MECM) on versions 2107 and 2203, this requires creating a package. For more information on how to deploy programs and scripts in Configuration Manager, see [Packages and programs in Configuration Manager](/configmgr/apps/deploy-use/packages-and-programs). You can also use MECM 2107, 2203 to migrate from the MMA-based version. For more information, see [Migrating servers from Microsoft Monitoring Agent to the unified solution](application-deployment-via-mecm.md). +- MECM 2107 with the hotfix rollup or later is required to support policy configuration management using the Endpoint Protection node. +- Microsoft Endpoint Configuration Manager 2207 or later supports [automated installation and onboarding](/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#bkmk_2207) ++#### Workaround for a known issue with TelemetryProxyServer on disconnected machines ++Problem description: +When using the TelemetryProxyServer setting to specify a proxy to be used by the EDR component of Microsoft Defender for Endpoint, on machines that have no other way to access the Certificate Revocation List (CRL) URL, a missing intermediate certificate will cause the EDR sensor to not successfully connect to the cloud service. ++Affected scenario: +-Microsoft Defender for Endpoint with Sense version number 10.8048.22439.1065 or earlier preview versions running on Windows Server 2012 R2 +-Using the TelemetryProxyServer proxy configuration; other methods aren't affected ++Workaround: +1. Ensure the machine is running Sense version 10.8048.22439.1065 or higher by either installing using the latest package available from the onboarding page, or by applying KB5005292. +2. Download and unzip the certificate from https://github.com/microsoft/mdefordownlevelserver/blob/main/InterCA.zip +3. Import the certificate to the Local Computer trusted "Intermediate Certification Authorities" store. +You can use the PowerShell command: +Import-Certificate -FilePath .\InterCA.cer -CertStoreLocation Cert:\LocalMachine\Ca + ## Windows Server Semi-Annual Enterprise Channel (SAC), Windows Server 2019 and Windows Server 2022 ### Download package For other Windows server versions, you have two options to offboard Windows serv > [!NOTE] > These offboarding instructions for other Windows server versions also apply if you are running the previous Microsoft Defender for Endpoint for Windows Server 2016 and Windows Server 2012 R2 that requires the MMA. Instructions to migrate to the new unified solution are at [Server migration scenarios in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/server-migration). -## Related topics +## Related articles - [Onboard previous versions of Windows](onboard-downlevel.md) - [Onboard Windows 10 devices](configure-endpoints.md) |
| security | Deployment Rings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deployment-rings.md | The following table shows the supported endpoints and the corresponding tool you |Endpoint|Deployment tool| |||-|**Windows**|[Local script (up to 10 devices)](configure-endpoints-script.md) <br> NOTE: If you want to deploy more than 10 devices in a production environment, use the Group Policy method instead or the other supported tools listed below.<br> [Group Policy](configure-endpoints-gp.md) <br> [Microsoft Endpoint Manager/ Mobile Device Manager](configure-endpoints-mdm.md) <br> [Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) <br> [VDI scripts](configure-endpoints-vdi.md) <br> [Integration with Microsoft Defender for Cloud](configure-server-endpoints.md#integration-with-microsoft-defender-for-cloud)| +|**Windows**|[Local script (up to 10 devices)](configure-endpoints-script.md) <br> NOTE: If you want to deploy more than 10 devices in a production environment, use the Group Policy method instead or the other supported tools listed below.<br> [Group Policy](configure-endpoints-gp.md) <br> [Microsoft Endpoint Manager/ Mobile Device Manager](configure-endpoints-mdm.md) <br> [Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) <br> [VDI scripts](configure-endpoints-vdi.md) | |**macOS**|[Local script](mac-install-manually.md) <br> [Microsoft Endpoint Manager](mac-install-with-intune.md) <br> [JAMF Pro](mac-install-with-jamf.md) <br> [Mobile Device Management](mac-install-with-other-mdm.md)| |**Linux Server**|[Local script](linux-install-manually.md) <br> [Puppet](linux-install-with-puppet.md) <br> [Ansible](linux-install-with-ansible.md)| |**iOS**|[Microsoft Endpoint Manager](ios-install.md)| |
| security | Deployment Strategy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deployment-strategy.md | audience: ITPro - M365-security-compliance - m365-initiative-defender-endpoint-+ search.appverid: met150 The following table lists the supported endpoints and the corresponding deployme |Endpoint|Deployment tool| |||-|**Windows**|[Local script (up to 10 devices)](configure-endpoints-script.md) <br> [Group Policy](configure-endpoints-gp.md) <br> [Microsoft Endpoint Manager/ Mobile Device Manager](configure-endpoints-mdm.md) <br> [Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) <br> [VDI scripts](configure-endpoints-vdi.md) <br> [Integration with Microsoft Defender for Cloud](configure-server-endpoints.md#integration-with-microsoft-defender-for-cloud)| +|**Windows**|[Local script (up to 10 devices)](configure-endpoints-script.md) <br> [Group Policy](configure-endpoints-gp.md) <br> [Microsoft Endpoint Manager/ Mobile Device Manager](configure-endpoints-mdm.md) <br> [Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) <br> [VDI scripts](configure-endpoints-vdi.md) | |**macOS**|[Local script](mac-install-manually.md) <br> [Microsoft Endpoint Manager](mac-install-with-intune.md) <br> [JAMF Pro](mac-install-with-jamf.md) <br> [Mobile Device Management](mac-install-with-other-mdm.md)| |**Linux Server**|[Local script](linux-install-manually.md) <br> [Puppet](linux-install-with-puppet.md) <br> [Ansible](linux-install-with-ansible.md)| |**iOS**|[App-based](ios-install.md)| |
| security | Device Health Microsoft Defender Antivirus Health | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-health-microsoft-defender-antivirus-health.md | The following table contains a list of terms that are new to Microsoft Defender |:|:| | Security intelligence publish time | Indicates Microsoft’s release date of the security intelligence update version on the device. Devices with a security intelligence publish time greater than seven days are considered out of date in the reports. | | Last seen | Indicates date when device last had connection. |-| Data refresh timestamp | Indicates when client events were last received for reporting on AV mode, AV engine version, AV platform version, AV security intelligence version, and scan information. | +| Data refresh timestamp | Indicates when client events were last received for reporting on: AV mode, AV engine version, AV platform version, AV security intelligence version, and scan information. | | Signature refresh time | Indicates when client events were last received for reporting on engine, platform, and signature up to date status. | Within the flyout: clicking on the name of the device will redirect you to the "Device page" for that device, where you can access detailed reports. There are two levels of reports that you can export: There are two different export csv functionalities through the portal: -- **Top-level export** You can use the top level **Export** button to gather an all-up Microsoft Defender Antivirus health report (500 K limit).+- **Top-level export** You can use the top level **Export** button to gather an all-up Microsoft Defender Antivirus health report (500-K limit). >:::image type="content" source="images/device-health-defender-antivirus-health-tab-export.png" alt-text="Shows the top-level export report button" lightbox="images/device-health-defender-antivirus-health-tab-export.png"::: -- **Flyout level export** You can use the **Export** button within the flyouts to export a report to an Excel spreadsheet (100 K limit).+- **Flyout level export** You can use the **Export** button within the flyouts to export a report to an Excel spreadsheet (100-K limit). Exported reports capture information based on your entry-point into the details report and which filters or customized columns you have set. For more information on the current versions and how to update the different Mic The up-to-date cards show the up-to-date status for **Antivirus engine**, **Antivirus platform**, and **Security intelligence** update versions. There are three possible states: _Up to date_ (‘True’), _out of date_ (‘False’), and _no data available_ (‘Unknown’). +> [!IMPORTANT] +> +> The logic used to make up-to-date determination has recently been enhanced and simplified. The new behavior is documented in this section. + Definitions for  _Up to date_, _out of date_, and _no data available_ are provided for each card below. -Microsoft Defender Antivirus makes up-to-date reports and determinations based on the following criteria: +Microsoft Defender Antivirus uses the additional criteria of “Signature refresh time” (the last time device communicated with up to date reports) to make up-to-date reports and determinations for engine, platform, and security intelligence updates. -- **For engine & platform updates**: "Signature Refresh Time" (the time client events were last received for up to date reports) and "Security Intelligence Publish Time" (security intelligence VDMs are used to determine engine & platform versions)-- **For security intelligence updates**: "Signature Refresh Time" (the time client events were last received for up to date reports), Security Intelligence Publish Time, and the last up-to-date status communicated from client+The up-to-date status is automatically marked as “unknown” or “no data available” if the device hasn't communicated with reports for more than seven days (signature refresh time >7). For more information about the aforementioned terms, refer back to the section: [New Microsoft Defender Antivirus filter definitions](#new-microsoft-defender-antivirus-filter-definitions) Following are up-to-date definitions for engine and platform: | The engine/platform on the device is considered: | If: | |:|:|-| **up-to-date** | the device communicated with the Defender report event (‘Signature refresh time’) within last seven days and has a security intelligence publish time within last seven days and the Engine or Platform version build time is within last 60 days. | -| **out-of-date** | the device communicated with the Defender report event (‘Signature refresh time’) within last seven days and has a security intelligence publish time within last seven days but Engine or Platform version build time is older than 60 days. | -| **unknown (no data available)** | the device hasn't communicated with the report event (‘Signature refresh time’) for more than seven days, or the security intelligence publish time is greater than seven days. | +| **up-to-date** | the device communicated with the Defender report event (‘Signature refresh time’) within last seven days, and the Engine or Platform version build time is within last 60 days. | +| **out-of-date** | the device communicated with the Defender report event (‘Signature refresh time’) within last seven days, but Engine or Platform version build time is older than 60 days. | +| **unknown (no data available)** | the device hasn't communicated with the report event (‘Signature refresh time’) for more than seven days. | Following are up-to-date definitions for security intelligence: | The security intelligence update is considered | If: | |:|:|-|Up-to date | the security intelligence version on the device was written in the past seven days and the device has communicated with the report event in past seven days. | +|**Up-to date** | the security intelligence version on the device was written in the past seven days and the device has communicated with the report event in past seven days. | For more information, see: This card identifies devices that have antivirus engine versions that are up to **The general definition of ‘_Up to date_’** - The engine version on the device is the most recent engine release. The engine is _typically_ released monthly, via Windows Update (WU)). There's a three-day grace period given from the day when Windows Update (WU) is released. -The following table lays out the possible values for up to date reports for **Antivirus Engine**. Reported Status is based on the last time reporting event was received and security intelligence publish time. +The following table lays out the possible values for up to date reports for **Antivirus Engine**. Reported Status is based on the last time reporting event was received (_signature refresh time_). If the device hasn't communicated with reports for more than seven days (signature refresh time >7 days), then the status is automatically marked as ‘Unknown’ / ‘No Data Available’. -| Event’s Last Refresh Time (also known as “Signature Refresh Time” in reports) | Security Intelligence Publish Time | _Reported Status_: | -|:-|:-|:-| -| < 7 days (new) | < 7 days (new) | _Up to date <br/> Out of date <br/> Unknown (whatever client reports)_ | -| > 7 days (old) | > 7 days (old) | _Unknown_ | -| < 7 days (new) | > 7 days (old) | _Unknown_ | -| > 7 days (old) | < 7 days (new) | _Unknown_ | +| Event’s Last Refresh Time (also known as “Signature Refresh Time” in reports) | _Reported Status_: | +|:-|:-| +| < 7 days (new) | whatever client reports (_Up to date <br/> Out of date <br/> Unknown)_ | +| > 7 days (old) | _Unknown_ | For information about Manage Microsoft Defender Antivirus update versions, see: [Monthly platform and engine versions](manage-updates-baselines-microsoft-defender-antivirus.md#monthly-platform-and-engine-versions) For information about Manage Microsoft Defender Antivirus update versions, see: This card identifies devices that have Antivirus platform versions that are up to date versus out of date. -**The general definition of ‘Up to date’** The platform version on the device is the most recent platform release. Platform is typically released monthly, via Windows Update). There's a three-day grace period from the day when WU is released. +**The general definition of ‘Up to date’** The platform version on the device is the most recent platform release. Platform is _typically_ released monthly, via Windows Update (WU). There's a three-day grace period from the day when WU is released. -The following table lays out the possible up to date report values for **Antivirus Platform**. Reported values are based on the last time reporting event was received and security intelligence publish time. +The following table lays out the possible up to date report values for **Antivirus Platform**. Reported values are based on the last time reporting event was received (signature refresh time). If the device hasn't communicated with reports for more than seven days (signature refresh time >7 days) then the status is automatically marked as ‘Unknown’/ ‘No Data Available’. -| Event’s Last Refresh Time (also known as “Signature Refresh Time” in reports) | Security Intelligence Publish Time | _Reported Status_: | -|:-|:-|:-| -| < 7 days (new) | < 7 days (new) | _Up to date <br/> Out of date <br/> Unknown (whatever client reports)_ | -| > 7 days (old) | > 7 days (old) | _Unknown_ | -| < 7 days (new) | > 7 days (old) | _Unknown_ | -| > 7 days (old) | < 7 days (new) | _Unknown_ | +| Event’s Last Refresh Time (also known as “Signature Refresh Time” in reports) | _Reported Status_: | +|:-|:-| +| < 7 days (new) | whatever client reports (_Up to date <br/> Out of date <br/> Unknown)_ | +| > 7 days (old) | _Unknown_ | For information about Manage Microsoft Defender Antivirus update versions, see: [Monthly platform and engine versions](manage-updates-baselines-microsoft-defender-antivirus.md#monthly-platform-and-engine-versions) This card identifies devices that have security intelligence versions that are u **The general definition of ‘Up to date’** – the security intelligence version on the device was written in the past 7 days. -The following table lays out the possible up to date report values for **Security Intelligence** updates. Reported values are based on the last time reporting event was received, the security intelligence publish time, and the last status received from client. --| Event’s Last Refresh Time <br/> (Also known as “Signature Refresh Time” in reports) | Security Intelligence Publish Time | Last status received from client | _Reported Status_: | -|:-|:-|:-|:-| -| >7 days (old) | >7 days (old) | Up to date | _Unknown_ | -| <7 days (new) | >7 days (old) | Up to date | _Unknown_ | -| >7 days (old) | <7 days (new) | Up to date | _Unknown_ | -| <7 days (new) | <7 days (new) | Unknown | _Unknown_| -| <7 days (new) | <7 days (new) | Up to date | _Up to date_ | -| >7 days (old) | <7 days (new) | Out of date | _Out of date_ | -| >7 days (old) | >7 days (old) | Out of date | _Out of date_ | -| <7 days (new) | >7 days (old) | Out of date | _Out of date_ | +The following table lays out the possible up to date report values for **Security Intelligence** updates. Reported values are based on the last time reporting event was received, and the security intelligence publish time. If the device hasn't communicated with reports for more than seven days (signature refresh time >7 days), then the status is automatically marked as ‘Unknown/ No Data Available’. Otherwise, the determination is made based on whether the security intelligence publish time is within seven days. ++| Event’s Last Refresh Time <br/> (Also known as “Signature Refresh Time” in reports) | Security Intelligence Publish Time | _Reported Status_: | +|:-|:-|:-| +| >7 days (old) | >7 days (old) | _Unknown_ | +| <7 days (new) | >7 days (old) | _Out of date_ | +| >7 days (old) | <7 days (new) | _Unknown_ | +| <7 days (new) | <7 days (new) | Up to date | ## See also |
| security | Gov | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/gov.md | These are the known gaps: |Feature name|GCC|GCC High|DoD| ||::|::|::|+|Reports: Web content filtering|||| |Reports: Device health| <sup>1</sup>| In development| In development|-|Reports: Web content filtering|| In development| In development| |Microsoft Secure Score| <sup>1</sup>||| |Microsoft Threat Experts|||| > [!NOTE] These are the known gaps: These are the features and known gaps for [Mobile Threat Defense (Microsoft Defender for Endpoint on Android & iOS)](mtd.md): -<br /> --**** - |Feature name|GCC|GCC High|DoD| ||::|::|::| |Web Protection (Anti-Phishing and custom indicators)|||| |
| security | Ios Install | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/ios-install.md | This step simplifies the onboarding process by setting up the VPN profile. For a :::image type="content" source="images/ios-deploy-8.png" alt-text="The VPN profile Configuration settings tab" lightbox="images/ios-deploy-8.png"::: - To mandate that VPN cannot be disabled in users device, Admins can select **Yes** from **Block users from disabling automatic VPN**. By default, it's not configured and users can disable VPN only in the Settings.- - To allow Users to Change the VPN toggle from within the app, add **EnableVPNToggleInApp = TRUE**, in the key-value pairs. By default, users cannot the change the toggle from within the app. + - To allow Users to Change the VPN toggle from within the app, add **EnableVPNToggleInApp = TRUE**, in the key-value pairs. By default, users cannot change the toggle from within the app. 1. Click Next and assign the profile to targeted users. 1. In the *Review + Create* section, verify that all the information entered is correct and then select **Create**. Admins can configure Microsoft Defender for Endpoint to deploy and activate sile :::image type="content" source="images/ios-deploy-9.png" alt-text="The VPN profile Configuration page" lightbox="images/ios-deploy-9.png"::: - To mandate that VPN can't be disabled in users device, Admins can select **Yes** from **Block users from disabling automatic VPN**. By default, it's not configured and users can disable VPN only in the Settings.- - To allow Users to Change the VPN toggle from within the app, add **EnableVPNToggleInApp = TRUE**, in the key-value pairs. By default, users can't the change the toggle from within the app. + - To allow Users to Change the VPN toggle from within the app, add **EnableVPNToggleInApp = TRUE**, in the key-value pairs. By default, users can't change the toggle from within the app. 1. Select **Next** and assign the profile to targeted users. 1. In the *Review + Create* section, verify that all the information entered is correct and then select **Create**. Intune allows you to configure the Defender for iOS app through an App Configura 1. In the next screen, select **Use configuration designer** as the format. Specify the following property: - Configuration Key: `issupervised` - Value type: String- - Configuration Value: `issupervised` + - Configuration Value: `{{issupervised}}` > :::image type="content" source="images/ios-deploy-6.png" alt-text="The page from which to choose the format for the settings of the policy configuration" lightbox="images/ios-deploy-6.png"::: |
| security | Onboard Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/onboard-configure.md | The following table lists the available tools based on the endpoint that you nee | Endpoint | Tool options | |--||-| **Windows Client** | [Mobile Device Management / Microsoft Intune](configure-endpoints-mdm.md) <br> [Group Policy](configure-endpoints-gp.md) <br> [Local script (up to 10 devices)](configure-endpoints-script.md) <br>[VDI scripts](configure-endpoints-vdi.md) <br> [Integration with Microsoft Defender for Cloud](configure-server-endpoints.md#integration-with-microsoft-defender-for-cloud) | -| **Windows Server** | [Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) <br> [Group Policy](configure-endpoints-gp.md) <br> [VDI scripts](configure-endpoints-vdi.md) <br> [Integration with Microsoft Defender for Cloud](configure-server-endpoints.md#integration-with-microsoft-defender-for-cloud) | +| **Windows Client** | [Mobile Device Management / Microsoft Intune](configure-endpoints-mdm.md) <br> [Group Policy](configure-endpoints-gp.md) <br> [Local script (up to 10 devices)](configure-endpoints-script.md) <br>[VDI scripts](configure-endpoints-vdi.md) | +| **Windows Server** | [Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) <br> [Group Policy](configure-endpoints-gp.md) <br> [VDI scripts](configure-endpoints-vdi.md) <br> [Onboard Windows servers to the Microsoft Defender for Endpoint service](configure-server-endpoints.md) | | **macOS** | [Local scripts](mac-install-manually.md) <br> [Microsoft Endpoint Manager](mac-install-with-intune.md) <br> [JAMF Pro](mac-install-with-jamf.md) <br> [Mobile Device Management](mac-install-with-other-mdm.md) |-| **Linux Server** | [Local script](linux-install-manually.md) <br> [Puppet](linux-install-with-puppet.md) <br> [Ansible](linux-install-with-ansible.md) <br> [Integration with Microsoft Defender for Cloud](configure-server-endpoints.md#integration-with-microsoft-defender-for-cloud) | +| **Linux Server** | [Local script](linux-install-manually.md) <br> [Puppet](linux-install-with-puppet.md) <br> [Ansible](linux-install-with-ansible.md) | | **iOS** | [Microsoft Endpoint Manager](ios-install.md) | | **Android** | [Microsoft Endpoint Manager](android-intune.md) | |
| security | Schedule Antivirus Scans | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/schedule-antivirus-scans.md | search.appverid: met150 **Platforms** - Windows -In addition to always-on, real-time protection and [on-demand antivirus](run-scan-microsoft-defender-antivirus.md) scans, you can set up regular, scheduled antivirus scans. You can configure the type of scan, when the scan should occur, and if the scan should occur after a [protection update](manage-protection-updates-microsoft-defender-antivirus.md) or when an endpoint is not being used. You can also set up special scans to complete remediation actions if needed. +In addition to always-on, real-time protection and [on-demand antivirus](run-scan-microsoft-defender-antivirus.md) scans, you can set up regular, scheduled antivirus scans. You can configure the type of scan, when the scan should occur, and if the scan should occur after a [protection update](manage-protection-updates-microsoft-defender-antivirus.md) or when an endpoint isn't being used. You can also set up special scans to complete remediation actions if needed. ## What do you want to do? When you set up scheduled scans, you can specify whether the scan should be a fu |Quick scan|Full scan|Custom scan| ||||-|(Recommended) A quick scan looks at all the locations where there could be malware registered to start with the system, such as registry keys and known Windows startup folders. <br/><br/>Combined with always-on, real-time protection, which reviews files when they are opened and closed, and whenever a user navigates to a folder, a quick scan helps provide strong protection against malware that starts with the system and kernel-level malware.<br/><br/>In most cases, a quick scan is sufficient and is the recommended option for scheduled scans.|A full scan starts by running a quick scan and then continues with a sequential file scan of all mounted fixed disks and removable/network drives (if the full scan is configured to do so).<br/><br/>A full scan can take a few hours or days to complete, depending on the amount and type of data that needs to be scanned.<br/><br/>When the full scan is complete, new security intelligence is available, and a new scan is then required to make sure that no other threats are detected with the new security intelligence.<br/><br/>Because of the time and resources involved in a full scan, in general, Microsoft does not recommend scheduling full scans.|A custom scan runs on files and folders that you specify. For example, you can choose to scan a USB drive, or a specific folder on your device's local drive.| +|(Recommended) A quick scan looks at all the locations where there could be malware registered to start with the system, such as registry keys and known Windows startup folders. <br/><br/>Combined with always-on, real-time protection, which reviews files when they're opened and closed, and whenever a user navigates to a folder, a quick scan helps provide strong protection against malware that starts with the system and kernel-level malware.<br/><br/>In most cases, a quick scan is sufficient and is the recommended option for scheduled scans.|A full scan starts by running a quick scan and then continues with a sequential file scan of all mounted fixed disks and removable/network drives (if the full scan is configured to do so).<br/><br/>A full scan can take a few hours or days to complete, depending on the amount and type of data that needs to be scanned.<br/><br/>When the full scan is complete, new security intelligence is available, and a new scan is then required to make sure that no other threats are detected with the new security intelligence.<br/><br/>Because of the time and resources involved in a full scan, in general, Microsoft doesn't recommend scheduling full scans.|A custom scan runs on files and folders that you specify. For example, you can choose to scan a USB drive, or a specific folder on your device's local drive.| > [!NOTE] > By default, quick scans run on mounted removable devices, such as USB drives. Use the following table to choose a scan type. |Scenario|Recommended scan type| |||-|You want to set up regular, scheduled scans|Quick scan <p> A quick scan checks the processes, memory, profiles, and certain locations on the device. Combined with [always-on real-time protection](configure-real-time-protection-microsoft-defender-antivirus.md), a quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware. Real-time protection reviews files when they are opened and closed, and whenever a user navigates to a folder.| +|You want to set up regular, scheduled scans|Quick scan <p> A quick scan checks the processes, memory, profiles, and certain locations on the device. Combined with [always-on real-time protection](configure-real-time-protection-microsoft-defender-antivirus.md), a quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware. Real-time protection reviews files when they're opened and closed, and whenever a user navigates to a folder.| |Threats, such as malware, are detected on an individual device|Quick scan <p> In most cases, a quick scan will catch and clean up detected malware.| |You want to run an [on-demand scan](run-scan-microsoft-defender-antivirus.md)|Quick scan|-|You want to make sure a portable device, such as a USB drive, does not contain malware|Custom scan <p> A custom scan enables you to select specific locations, folders, or files, and runs a quick scan.| +|You want to make sure a portable device, such as a USB drive, doesn't contain malware|Custom scan <p> A custom scan enables you to select specific locations, folders, or files, and runs a quick scan.| | You have just installed or re-enabled Microsoft Defender Antivirus | Full scan <p>Running a full scan after you've just enabled or installed Microsoft Defender Antivirus helps populate the cache for future scans. The full scan can also help detect existing threats on the device. | ## What else do I need to know about quick and full scans? -- Malicious files can be stored in locations that are not included in a quick scan. However, always-on real-time protection reviews all files that are opened and closed, and any files that are in folders that are accessed by a user. The combination of real-time protection and a quick scan helps provide strong protection against malware.+- Malicious files can be stored in locations that aren't included in a quick scan. However, always-on real-time protection reviews all files that are opened and closed, and any files that are in folders that are accessed by a user. The combination of real-time protection and a quick scan helps provide strong protection against malware. - On-access protection with [cloud-delivered protection](cloud-protection-microsoft-defender-antivirus.md) helps ensure that all the files accessed on the system are being scanned with the latest security intelligence and cloud machine learning models. -- When real-time protection detects malware and the extent of the affected files is not determined initially, Microsoft Defender Antivirus initiates a full scan as part of the remediation process.+- When real-time protection detects malware and the extent of the affected files isn't determined initially, Microsoft Defender Antivirus initiates a full scan as part of the remediation process. -- A full scan can detect malicious files that were not detected by other scans, such as a quick scan. However, a full scan can take a while and use valuable system resources to complete.+- A full scan can detect malicious files that weren't detected by other scans, such as a quick scan. However, a full scan can take a while and use valuable system resources to complete. - If a device is offline for an extended period of time, a full scan can take longer to complete. +## Scheduled Quick Scan Performance Optimization ++As a performance optimization, Microsoft Defender Antivirus will skip running scheduled quick scans in some situations. This optimization only applies to a quick scan when initiated by a schedule ΓÇô it doesn't affect a quick scan initiated by an [on-demand antivirus](run-scan-microsoft-defender-antivirus.md) scan. This optimization reduces performance degradation by avoiding running a quick scan when it isn't necessary and won't affect protection. ++By default, if a qualified quick scan was run within the last seven days, a new quick scan won't be initiated. A quick scan is considered qualified if it occurs after the last [Security Intelligence Update](manage-updates-baselines-microsoft-defender-antivirus.md) was installed, Real-Time Protection was not disabled during that period, and if the machine was rebooted. ++This optimization doesn't apply to the following conditions: ++- If Microsoft Defender for Endpoint is [Managed](configuration-management-reference-microsoft-defender-antivirus.md) ++- If Microsoft Defender [Endpoint Detection and Response (EDR)](overview-endpoint-detection-response.md) is installed ++- If the computer was restarted since the last quick scan ++- If Microsoft Defender for Endpoint Real-Time Protection has been disabled since the last quick scan occurred, including if it's currently disabled ++- If the last initiated quick scan wasn't completed ++This optimization applies to machines running Windows 10 Anniversary Update (version 1607) and all subsequent Windows releases, as well as Windows Server 2016 (version 1607) and subsequent Windows Server releases, but doesn't apply to Core Server installations. + > [!TIP] > If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) |
| security | Switch To Mde Phase 3 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/switch-to-mde-phase-3.md | search.appverid: met150 ### Onboarding methods -> [!IMPORTANT] -> If you are using Microsoft Defender for Cloud, see [Integration with Microsoft Defender for Cloud](configure-server-endpoints.md#integration-with-microsoft-defender-for-cloud). - Deployment methods vary, depending on operating system and preferred methods. The following table lists resources to help you onboard to Defender for Endpoint: |Operating systems |Methods | |
| security | Tamperprotection Macos | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/tamperprotection-macos.md | You can configure the tamper protection mode by providing the mode name as enfor - Supported macOS versions: Monterey (12), Big Sur (11), Catalina (10.15+). - Minimum required version for Defender for Endpoint: 101.70.19.-- You must be on a non-Production update channel ([either Preview or Beta](/deployoffice/office-insider/deploy/microsoft-autoupdate)), while the Tamper Protection feature is in preview. If you are on Production channel, configured tamper protection mode will ignored. **Highly recommended settings:** |
| security | Eval Defender Endpoint Enable Eval | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-endpoint-enable-eval.md | f1.keywords: - NOCSH Previously updated : 07/09/2021 Last updated : 09/22/2022 ms.localizationpriority: medium audience: ITPro Watch this video for a quick overview of the onboarding process and learn about The following table lists the available tools based on the endpoint that you need to onboard. -Endpoint | Tool options -:|: -**Windows** | [Local script (up to 10 devices)](../defender-endpoint/configure-endpoints-script.md), [Group Policy](../defender-endpoint/configure-endpoints-gp.md), [Microsoft Endpoint Manager/ Mobile Device Manager](../defender-endpoint/configure-endpoints-mdm.md), [Microsoft Endpoint Configuration Manager](../defender-endpoint/configure-endpoints-sccm.md), [VDI scripts](../defender-endpoint/configure-endpoints-vdi.md), [Integration with Microsoft Defender for Cloud](../defender-endpoint/configure-server-endpoints.md#integration-with-microsoft-defender-for-cloud) -**macOS** | [Local scripts](../defender-endpoint/mac-install-manually.md), [Microsoft Endpoint Manager](../defender-endpoint/mac-install-with-intune.md), [JAMF Pro](../defender-endpoint/mac-install-with-jamf.md), [Mobile Device Management](../defender-endpoint/mac-install-with-other-mdm.md) -**Linux Server** | [Local script](../defender-endpoint/linux-install-manually.md), [Puppet](../defender-endpoint/linux-install-with-puppet.md), [Ansible](../defender-endpoint/linux-install-with-ansible.md) -**iOS** | [App-based](../defender-endpoint/ios-install.md) -**Android** | [Microsoft Endpoint Manager](../defender-endpoint/android-intune.md) +| Endpoint | Tool options | +|:|:| +| **Windows** |- [Local script (up to 10 devices)](../defender-endpoint/configure-endpoints-script.md)<br/>- [Group Policy](../defender-endpoint/configure-endpoints-gp.md)<br/>- [Microsoft Endpoint Manager/ Mobile Device Manager](../defender-endpoint/configure-endpoints-mdm.md)<br/>- [Microsoft Endpoint Configuration Manager](../defender-endpoint/configure-endpoints-sccm.md)<br/>- [VDI scripts](../defender-endpoint/configure-endpoints-vdi.md) | +| **macOS** | - [Local scripts](../defender-endpoint/mac-install-manually.md)<br/>- [Microsoft Endpoint Manager](../defender-endpoint/mac-install-with-intune.md)<br/>- [JAMF Pro](../defender-endpoint/mac-install-with-jamf.md)<br/>- [Mobile Device Management](../defender-endpoint/mac-install-with-other-mdm.md) | +| **Linux Server** | - [Local script](../defender-endpoint/linux-install-manually.md)<br/>- [Puppet](../defender-endpoint/linux-install-with-puppet.md)<br/>- [Ansible](../defender-endpoint/linux-install-with-ansible.md) | +| **iOS** | [App-based](../defender-endpoint/ios-install.md) | +| **Android** | [Microsoft Endpoint Manager](../defender-endpoint/android-intune.md) | |
| security | Permissions In The Security And Compliance Center | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/permissions-in-the-security-and-compliance-center.md | To see how to grant access to the Security & Compliance Center, check out [Give |**Information Protection Analysts**|Access and manage DLP alerts and activity explorer. View-only access to DLP policies, sensitivity labels and their policies, and all classifier types.|Data Classification List Viewer <br/><br/> Information Protection Analyst| |**Information Protection Investigators**|Access and manage DLP alerts, activity explorer, and content explorer. View-only access to DLP policies, sensitivity labels and their policies, and all classifier types.|Data Classification Content Viewer <br/><br/> Information Protection Analyst <br/><br/> Information Protection Investigator| |**Information Protection Readers**|View-only access to reports for DLP policies and sensitivity labels and their policies.|Information Protection Reader|-|**Insider Risk Management**|Use this role group to manage insider risk management for your organization in a single group. By adding all user accounts for designated administrators, analysts, and investigators, you can configure insider risk management permissions in a single group. This role group contains all the insider risk management permission roles. This is the easiest way to quickly get started with insider risk management and is a good fit for organizations that do not need separate permissions defined for separate groups of users.|Case Management <br/><br/> Data Connector Admin <br/><br/> Insider Risk Management Admin <br/><br/> Insider Risk Management Analysis <br/><br/> Insider Risk Management Audit <br/><br/> Insider Risk Management Investigation <br/><br/> Insider Risk Management Sessions <br/><br/> View-Only Case| +|**Insider Risk Management**|Use this role group to manage insider risk management for your organization in a single group. By adding all user accounts for designated administrators, analysts, and investigators, you can configure insider risk management permissions in a single group. This role group contains all the insider risk management permission roles. This is the easiest way to quickly get started with insider risk management and is a good fit for organizations that do not need separate permissions defined for separate groups of users.|Case Management <br/><br/> Data Connector Admin <br/><br/> Insider Risk Management Admin <br/><br/> Insider Risk Management Analysis <br/><br/> Insider Risk Management Audit <br/><br/> Insider Risk Management Investigation <br/><br/> View-Only Case| |**Insider Risk Management Admins**|Use this role group to initially configure insider risk management and later to segregate insider risk administrators into a defined group. Users in this role group can create, read, update, and delete insider risk management policies, global settings, and role group assignments.|Case Management <br/><br/> Data Connector Admin <br/><br/> Insider Risk Management Admin <br/><br/> View-Only Case| |**Insider Risk Management Analysts**|Use this group to assign permissions to users that will act as insider risk case analysts. Users in this role group can access all insider risk management alerts, cases, and notices templates. They cannot access the insider risk Content Explorer.|Case Management <br/><br/> Insider Risk Management Analysis <br/><br/> View-Only Case| |**Insider Risk Management Auditors**|Use this group to assign permissions to users that will audit insider risk management activities. Users in this role group can access the insider risk audit log.|Insider Risk Management Audit| |**Insider Risk Management Investigators**|Use this group to assign permissions to users that will act as insider risk data investigators. Users in this role group can access all insider risk management alerts, cases, notices templates, and the Content Explorer for all cases.|Case Management <br/><br/> Insider Risk Management Investigation <br/><br/> View-Only Case|-|**Insider Risk Management Session Approvers**|Manage group modification requests for session recording.|Insider Risk Management Sessions| |**IRM Contributors**|This role group is visible, but is used by background services only.|Insider Risk Management Permanent contribution <br/><br/> Insider Risk Management Temporary contribution| |**Knowledge Administrators**|Configure knowledge, learning, assign trainings and other intelligent features.|Knowledge Admin| |**MailFlow Administrator**|Members can monitor and view mail flow insights and reports in the Security & Compliance Center. Global admins can add ordinary users to this group, but, if the user isn't a member of the Exchange Admin group, the user will not have access to Exchange admin-related tasks.|View-Only Recipients| Note that the following roles aren't assigned to the Organization Management rol - Insider Risk Management Audit - Insider Risk Management Investigation - Insider Risk Management Permanent contribution-- Insider Risk Management Sessions - Insider Risk Management Temporary contribution - Knowledge Admin - Preview Note that the following roles aren't assigned to the Organization Management rol |**Insider Risk Management Audit**|Allow viewing Insider Risk audit trails.|Insider Risk Management <br/><br/> Insider Risk Management Auditors| |**Insider Risk Management Investigation**|Access all insider risk management alerts, cases, notices templates, and the Content Explorer for all cases.|Insider Risk Management <br/><br/> Insider Risk Management Investigators| |**Insider Risk Management Permanent contribution**|This role group is visible, but is used by background services only.|IRM Contributors|-|**Insider Risk Management Sessions**|Allow managing group modification requests for session recording.|Insider Risk Management <br/><br/> Insider Risk Management Session Approvers| |**Insider Risk Management Temporary contribution**|This role group is visible, but is used by background services only.|IRM Contributors| |**Knowledge Admin**|Configure knowledge, learning, assign trainings and other intelligent features.|Knowledge Administrators| |**Manage Alerts**|View and edit settings and reports for alerts.|Compliance Administrator <p><p> Compliance Data Administrator <p> Organization Management <p> Security Administrator <p> Security Operator| |
| solutions | Allow Direct Connect With All Organizations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/allow-direct-connect-with-all-organizations.md | |
| solutions | Allow Members To Send As Or Send On Behalf Of Group | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/allow-members-to-send-as-or-send-on-behalf-of-group.md | |
| solutions | Architecture Icons Templates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/architecture-icons-templates.md | |
| solutions | B2b Extranet | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/b2b-extranet.md | |
| solutions | Best Practices Anonymous Sharing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/best-practices-anonymous-sharing.md | |
| solutions | Choose Domain To Create Groups | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/choose-domain-to-create-groups.md | |
| solutions | Cloud Architecture Models | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/cloud-architecture-models.md | |
| solutions | Collaborate As Team | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaborate-as-team.md | |
| solutions | Collaborate In Site | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaborate-in-site.md | |
| solutions | Collaborate On Documents | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaborate-on-documents.md | |
| solutions | Collaborate Teams Direct Connect | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaborate-teams-direct-connect.md | |
| solutions | Collaborate With People Outside Your Organization | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaborate-with-people-outside-your-organization.md | |
| solutions | Collaboration Governance First | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaboration-governance-first.md | |
| solutions | Collaboration Governance Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaboration-governance-overview.md | |
| solutions | Configure Teams Baseline Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/configure-teams-baseline-protection.md | |
| solutions | Configure Teams Highly Sensitive Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/configure-teams-highly-sensitive-protection.md | |
| solutions | Configure Teams Sensitive Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/configure-teams-sensitive-protection.md | |
| solutions | Configure Teams Three Tiers Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/configure-teams-three-tiers-protection.md | |
| solutions | Contoso Case Study Solutions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/contoso-case-study-solutions.md | |
| solutions | Contoso Remote Onsite Work | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/contoso-remote-onsite-work.md | |
| solutions | Contoso Team For Top Secret Project | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/contoso-team-for-top-secret-project.md | |
| solutions | Create Secure Guest Sharing Environment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/create-secure-guest-sharing-environment.md | |
| solutions | Design Principles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/design-principles.md | |
| solutions | Empower People To Work Remotely Manage Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-manage-endpoints.md | |
| solutions | Empower People To Work Remotely Remote Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-remote-access.md | |
| solutions | Empower People To Work Remotely Secure Sign In | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-secure-sign-in.md | |
| solutions | Empower People To Work Remotely Security Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-security-compliance.md | |
| solutions | Empower People To Work Remotely Teams Productivity Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-teams-productivity-apps.md | |
| solutions | Empower People To Work Remotely Train Monitor Usage | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-train-monitor-usage.md | |
| solutions | Empower People To Work Remotely | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely.md | |
| solutions | End Life Cycle Groups Teams Sites Yammer | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/end-life-cycle-groups-teams-sites-yammer.md | |
| solutions | Energy Secure Collaboration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/energy-secure-collaboration.md | |
| solutions | Financial Services Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/financial-services-overview.md | |
| solutions | Financial Services Secure Collaboration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/financial-services-secure-collaboration.md | |
| solutions | Groups Naming Policy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/groups-naming-policy.md | |
| solutions | Groups Services Interactions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/groups-services-interactions.md | |
| solutions | Groups Sharepoint Governance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/groups-sharepoint-governance.md | |
| solutions | Groups Sharepoint Teams Governance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/groups-sharepoint-teams-governance.md | |
| solutions | Groups Teams Access Governance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/groups-teams-access-governance.md | |
| solutions | Groups Teams Communication Governance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/groups-teams-communication-governance.md | |
| solutions | Groups Teams Compliance Governance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/groups-teams-compliance-governance.md | |
| solutions | Healthcare Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/healthcare-overview.md | |
| solutions | Identity Design Principles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/identity-design-principles.md | |
| solutions | Infographics For Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/infographics-for-users.md | |
| solutions | Information Protection Deploy Assess | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/information-protection-deploy-assess.md | |
| solutions | Information Protection Deploy Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/information-protection-deploy-compliance.md | |
| solutions | Information Protection Deploy Govern | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/information-protection-deploy-govern.md | |
| solutions | Information Protection Deploy Identity Device Threat | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/information-protection-deploy-identity-device-threat.md | |
| solutions | Information Protection Deploy Monitor Respond | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/information-protection-deploy-monitor-respond.md | |
| solutions | Information Protection Deploy Protect Information | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/information-protection-deploy-protect-information.md | |
| solutions | Information Protection Deploy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/information-protection-deploy.md | |
| solutions | Limit Guest Sharing To Specific Organization | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/limit-guest-sharing-to-specific-organization.md | |
| solutions | Limit Invitations From Specific Organization | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/limit-invitations-from-specific-organization.md | |
| solutions | Limit Organizations Where Users Have Guest Accounts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/limit-organizations-where-users-have-guest-accounts.md | |
| solutions | Limit Who Can Invite Guests | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/limit-who-can-invite-guests.md | |
| solutions | Manage Creation Of Groups | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-creation-of-groups.md | |
| solutions | Manage Devices With Intune App Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-app-protection.md | |
| solutions | Manage Devices With Intune Compliance Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-compliance-policies.md | |
| solutions | Manage Devices With Intune Configuration Profiles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-configuration-profiles.md | |
| solutions | Manage Devices With Intune Dlp Mip | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-dlp-mip.md | f1.keywords: audience: ITPro -+ ms.localizationpriority: high - highpri |
| solutions | Manage Devices With Intune Enroll | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-enroll.md | |
| solutions | Manage Devices With Intune Monitor Risk | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-monitor-risk.md | |
| solutions | Manage Devices With Intune Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-overview.md | |
| solutions | Manage Devices With Intune Require Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-require-compliance.md | |
| solutions | Microsoft 365 Groups Expiration Policy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/microsoft-365-groups-expiration-policy.md | |
| solutions | Microsoft 365 Guest Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/microsoft-365-guest-settings.md | |
| solutions | Microsoft 365 Limit Sharing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/microsoft-365-limit-sharing.md | |
| solutions | Networking Design Principles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/networking-design-principles.md | |
| solutions | Per Group Guest Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/per-group-guest-access.md | |
| solutions | Plan External Collaboration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/plan-external-collaboration.md | |
| solutions | Plan Organization Lifecycle Governance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/plan-organization-lifecycle-governance.md | |
| solutions | Productivity Illustrations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/productivity-illustrations.md | |
| solutions | Ransomware Protection Microsoft 365 Attack Detection Response | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/ransomware-protection-microsoft-365-attack-detection-response.md | |
| solutions | Ransomware Protection Microsoft 365 Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/ransomware-protection-microsoft-365-devices.md | |
| solutions | Ransomware Protection Microsoft 365 Identities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/ransomware-protection-microsoft-365-identities.md | |
| solutions | Ransomware Protection Microsoft 365 Information | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/ransomware-protection-microsoft-365-information.md | |
| solutions | Ransomware Protection Microsoft 365 Security Baselines | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/ransomware-protection-microsoft-365-security-baselines.md | |
| solutions | Ransomware Protection Microsoft 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/ransomware-protection-microsoft-365.md | |
| solutions | Retail Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/retail-overview.md | |
| solutions | Secure Teams Security Isolation | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/secure-teams-security-isolation.md | |
| solutions | Security Design Principles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/security-design-principles.md | |
| solutions | Setup Secure Collaboration With Teams | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/setup-secure-collaboration-with-teams.md | |
| solutions | Share Limit Accidental Exposure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/share-limit-accidental-exposure.md | |
| solutions | Team Security Isolation Dev Test | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/team-security-isolation-dev-test.md | |
| solutions | Tenant Management Device Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/tenant-management-device-management.md | |
| solutions | Tenant Management Identity | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/tenant-management-identity.md | |
| solutions | Tenant Management Migration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/tenant-management-migration.md | |
| solutions | Tenant Management Networking | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/tenant-management-networking.md | |
| solutions | Tenant Management Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/tenant-management-overview.md | |
| solutions | Tenant Management Tenants | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/tenant-management-tenants.md | |
| solutions | Test Lab Guides Overview Solutions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/test-lab-guides-overview-solutions.md | |
| solutions | Trust Conditional Access From Other Organizations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/trust-conditional-access-from-other-organizations.md | |