| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | M365 Copilot Setup | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/copilot/m365-copilot-setup.md | description: "Learn how to prepare your organization for Microsoft 365 Copilot." # Get started with Microsoft 365 Copilot >[!IMPORTANT]-> The information in this article only applies to the [Microsoft 365 Copilot Early Access Program](https://www.microsoft.com/microsoft-365/blog/2023/05/09/introducing-the-microsoft-365-copilot-early-access-program-and-new-capabilities-in-copilot/), an invite-only paid preview program for commercial customers. Details are subject to change. For more information on the Early Access Program, see [Microsoft 365 Early Access Program FAQ](m365-early-access-program.yml). +> The information in this article only applies to the [Microsoft 365 Copilot Early Access Program](https://www.microsoft.com/microsoft-365/blog/2023/05/09/introducing-the-microsoft-365-copilot-early-access-program-and-new-capabilities-in-copilot/), an invite-only preview program for commercial customers. Details are subject to change. [Microsoft 365 Copilot](https://www.microsoft.com/microsoft-365/blog/2023/03/16/introducing-microsoft-365-copilot-a-whole-new-way-to-work/) is an AI-powered productivity tool that uses large language models (LLMs) and integrates your data with the Microsoft Graph and Microsoft 365 Apps. It works alongside popular Microsoft 365 Apps such as Word, Excel, PowerPoint, Outlook, Teams, and more. Copilot provides real-time intelligent assistance, enabling users to enhance their creativity, productivity, and skills. This article covers the technical requirements to access and configure Microsoft 365 Copilot once you're invited to the Early Access Program. ## Prerequisites for Microsoft 365 Copilot -Before you can access Copilot, you must meet the following requirements: +Before you can access Copilot, you must meet these requirements: -- **Microsoft 365 Apps for enterprise** must be deployed for your users, which seamlessly integrates with Microsoft 365 Copilot and applications such as Word, Excel, PowerPoint, Outlook, and Teams. To get started with the implementation process, see [Deployment guide for Microsoft 365 Apps](/deployoffice/deployment-guide-microsoft-365-apps).--- **Azure Active Directory-based account** To use Microsoft 365 Copilot, you must have an Azure Active Directory-based account. To learn more, see [Azure Active Directory](/azure/active-directory/fundamentals/active-directory-whatis).+- The following applications must be deployed for your users, which seamlessly integrate with Microsoft 365 Copilot and other applications: + - Word + - Excel + - PowerPoint + - Outlook + - Microsoft Teams + - OneDrive + - SharePoint + - Exchange + +To get started with the implementation process, see [Deployment guide for Microsoft 365 Apps](/deployoffice/deployment-guide-microsoft-365-apps). - **OneDrive Account** You need to have a OneDrive account for several features within Microsoft 365 Copilot, such as saving and sharing your files. For more information, see [Sign in or create an account for OneDrive](https://support.microsoft.com/office/video-sign-in-or-create-an-account-for-onedrive-3adf09fd-90e3-4420-8c4e-b55e2cde40d2?ui=en-us&rs=en-us&ad=us). Before you can access Copilot, you must meet the following requirements: - **Microsoft Loop** To use Copilot in Microsoft Loop, you must have Loop enabled for your tenant. For more information on enabling Loop, see [Get started with Microsoft Loop](https://support.microsoft.com/office/get-started-with-microsoft-loop-9f4d8d4f-dfc6-4518-9ef6-069408c21f0c). >[!IMPORTANT]-> Your users must be on the Current Channel to access Copilot. To learn more, see [update channels for Microsoft 365 Apps](/deployoffice/updates/overview-update-channels#current-channel-overview). +> This note only applies to Microsoft 365 Apps for enterprise subscribers. Your users must be on the Current Channel to access Copilot. To learn more, see [update channels for Microsoft 365 Apps](/deployoffice/updates/overview-update-channels#current-channel-overview). >[!NOTE] > We previously stated that support for the Monthly Enterprise Channel was available for Microsoft 365 Copilot. As we continue to make frequent product updates and enhancements during the early access program, the time between updates in the Monthly Enterprise Channel limits Microsoft's ability to provide an optimum Copilot experience on desktop clients. Going forward, users in the early access program must be on the Current Channel to receive Copilot updates when they become available. We expect support in the Monthly Enterprise Channel in the future. You can also assign licenses in bulk to [groups of users through the Azure admin ## Security and privacy Microsoft 365 Copilot ensures data security and privacy by adhering to existing obligations and integrating with your organization's policies. It utilizes your Microsoft Graph content with the same access controls as other Microsoft 365 services. To learn more about privacy with Microsoft 365 Copilot, see [Data, Privacy, and Security for Microsoft 365 Copilot](/DeployOffice/privacy/microsoft-365-copilot).++## More resources ++- [Microsoft 365 Copilot setup guide](https://go.microsoft.com/fwlink/p/?linkid=2243702) +- [Microsoft 365 AI help and learning](https://support.microsoft.com/copilot) +- [Microsoft 365 Copilot - Microsoft Community Hub](https://techcommunity.microsoft.com/t5/microsoft-365-copilot/ct-p/Microsoft365Copilot) |
| commerce | Manage License Requests | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/manage-license-requests.md | Title: "Manage license requests" + Title: "Manage self-service license requests in the Microsoft 365 admin center" f1.keywords: - CSH -description: "Learn how to review and approve or deny license requests from users for your Microsoft 365 for business subscription." Previously updated : 06/13/2023+description: "Learn how to review and approve or deny license requests for products and services from users in the Microsoft 365 admin center." Last updated : 09/07/2023 -# Manage self-service license requests +# Manage self-service license requests in the Microsoft 365 admin center > [!NOTE]-> The information in this article only applies to self-service purchased products. To learn more, see [Self-service purchase FAQ](../subscriptions/self-service-purchase-faq.yml). +> The information in this article only applies to self-service purchased products and services. To learn more, see [Self-service purchase FAQ](../subscriptions/self-service-purchase-faq.yml). -If you disable self-service purchases in your organization, you can use licenses requests to manage the license request process for your users. When a user tries to make a self-service purchase for a product that you've blocked, they can submit a request for a license to you, the admin. When they make a request, they can add the names of other users who also need licenses for the product. +If you turn-off self-service purchases in your organization, you can set up license requests in the Microsoft 365 admin center to manage the license request process for your users. When a user tries to make a self-service purchase for a product that you've blocked, they can submit a request for a license to you, the admin. When they make a request, they can add the names of other users who also need licenses for the product. > [!NOTE] > If you block users from making self-service purchases, Microsoft doesn't send them marketing emails. Also, if they're using a trial version of a product, they don't see prompts to buy it. To learn more, see [Manage self-service purchases (Admin)](../subscriptions/manage-self-service-purchases-admins.md). -To see and manage license requests, admin uses the **Requests** tab on the **Licensing** page. The list shows the name of the product that is requested, name of the person requesting a license, date requested, and status of the request. Admins can filter the list to show requests that are pending or completed. Requests are held for 30 days. +To see and manage license requests, use the **Requests** tab on the **Licensing** page in the admin center. The list shows the name of the product requested, name of the person requesting a license, date requested, and status of the request. You can filter the list to show requests that are pending or completed. Requests are held for 30 days. ## Before you begin -You must be a Global admin to perform the tasks in this article. For more information, see [About admin roles](../../admin/add-users/about-admin-roles.md). +You must be a global, billing, or license admin to perform the tasks in this article. For more information, see [About admin roles](../../admin/add-users/about-admin-roles.md). ++> [!NOTE] +> If you're the person who signed up for the subscription, you're automatically a global admin. ## Use your own request process -If your organization has its own request process, you can use it instead. You create a message that is displayed to users when they request a license. +If your organization has its own request process, you can use it instead. You create a message to display to users when they request a license. > [!IMPORTANT] > If you use your own request process, no requests are displayed on the **Requests** tab. Existing requests from before you added your message continue to appear until you approve or decline them. -1. In the admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842264" target="_blank">Licenses</a> page, then select the **Requests** tab. -2. Select **Use your existing request process instead**. -3. In the right pane, in the **Message** box, type the message you want users to see when they request a license. If you want to also include a link to your organizations policy or other documentation, enter the URL in the **Link to documentation (optional)** text box. -4. Select **Save**. +1. In the Microsoft 365 admin center, select the **Navigation menu**, then select **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842264" target="_blank">Licenses</a>. +2. On the **Licenses** page, select the **Requests** tab, then select **Use your existing request process instead**. +3. In the **Use your request process** pane, select the **Use my organization's request process** check box. +4. In the **Message** box, type the message you want users to see when they request a license. If you want to also include a link to your organizations policy or other documentation, enter the URL in the **Link to documentation (optional)** text box. +5. Select **Save**. When you return to the **Requests** list, you see the message **You're using your own license request process**. To make changes to the message that is sent to users, select **Use your existing request process instead**. ## Stop using your own request process -1. In the admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842264" target="_blank">Licenses</a> page, then select the **Requests** tab. -2. Select **Use your existing request process instead**. -3. In the right pane, clear the **Use my organization's request process** check box. +1. In the admin center, select the **Navigation menu**, then select **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842264" target="_blank">Licenses</a>. +2. On the **Licenses** page, select the **Requests** tab, then select **Use your existing request process instead**. +3. In the **Use your request process** pane, clear **Use my organization's request process** check box. 4. Select **Save**. ## Approve or deny a license request -1. In the admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842264" target="_blank">Licenses</a> page, then select the **Requests** tab. -2. Select the row that contains the request you want to review. The right pane shows details about which users want licenses to the product. -3. To deny the entire request, select **Don't approve**, and in the dialog box, select **Don't approve**. -4. To deny some users for the request, but approve others, select the X by the name of the users that you want to remove. Their names are moved under **Do not assign to these users**. -5. If you have more than one product, under **Select a product**, select the one that you want to use to assign licenses for. -6. To deny users access to certain app and services, expand **Turn apps and services on or off**, then clear the check boxes for the ones you want to exclude. -7. At the bottom of the pane, type an optional message in the text box. -8. When you're finished, select **Approve**. The right pane shows the details of the request. -9. Close the right pane. - Users receive an email that says their request was approved or denied. +1. In the admin center, select the **Navigation menu**, then select **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842264" target="_blank">Licenses</a>. +2. On the **Licenses** page, select the **Requests** tab. +3. Select the row that contains the request you want to review. The side pane shows details about which users want licenses to the product. + - To deny the entire request, select **Don't approve**, and in the dialog box, select **Don't approve**. + - To deny some users but approve others, select the X by the name of the users that you want to remove. Their names are moved under **Do not assign to these users**. +4. If you have more than one product, under **Select a product**, select the one that you want to use to assign licenses for. +5. To deny users access to certain app and services, expand **Turn apps and services on or off**, then clear the check boxes for the ones that you want to exclude. +6. At the bottom of the pane, type an optional message in the text box. +7. When you're finished, select **Approve**. The pane shows the details of the request. +8. Close the pane. Users receive an email that says their request was approved or denied. ++## Share a license request by email ++If you donΓÇÖt have the authority within your organization to make decisions about who can receive a license for a particular product or service, you can share a license request via email with someone in your organization who does. You can only share one request at a time. The person who receives the license request email doesnΓÇÖt need access to the Microsoft 365 admin center to review the request. They simply respond to the email and indicate whether the person should be given the license they requested, and then you [approve or deny the request](#approve-or-deny-a-license-request). ++1. In the admin center, select the **Navigation menu**, then select **Billing** > **Licenses**. +2. On the **Licenses** page, select the <a href="https://go.microsoft.com/fwlink/p/?linkid=2245727" target="_blank">Auto-claim policy</a> tab. +3. Select the **Share request** tab, then select a request to share. +4. In the request pane, select **Share request**. +5. In the **Share license request details** pane, type an email address, then select the recipient name. + > [!NOTE] + > You can select more than one recipient, but if the email that you entered doesnΓÇÖt resolve into a user name, you canΓÇÖt share the request. +6. To personalize the email, select the **Include a personalized message** check box. Type a **Subject** and **Message** in the corresponding fields. +7. When youΓÇÖre finished, select **Share request**. ## Related content |
| frontline | Deploy Teams At Scale | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/deploy-teams-at-scale.md | You'll need to create two CSV files for each batch of teams that you deploy: |**User Full Name**|The display name of the user.| |**User UPN or ID**|The user principal name (UPN) or ID of the user. For example, averyh@contoso.com.| |**Team Name**|The name of the team.|- |**ActionType**|Whether you're adding or removing the user from the team. Options are **AddMember** and **RemoveMember**.| - |**Owner or Member**|Whether the user is a team owner or team member. Options are **Owner** and **Member**.| + |**ActionType**|Whether you're adding or removing the user from the team. Options are `AddMember` and `RemoveMember`.| + |**Owner or Member**|Whether the user is a team owner or team member. Options are `Owner` and `Member`.| #### Examples Use the following examples to help you create your CSV files. Here, we've named |User Full Name |User UPN or ID|Team Name|ActionType|Owner or Member| ||||||-|Avery Howard|averyh@contoso.com|Contoso Store 1|AddMember|Owner| -|Casey Jensen|caseyj@contoso.com|Contoso Store 2|AddMember|Owner| -|Jessie Irwin|jessiei@contoso.com|Contoso Store 3|AddMember|Owner| -|Manjeet Bhatia|manjeetb@contoso.com|Contoso Store 4|AddMember|Owner| -|Mikaela Lee|mikaelal@contoso.com|Contoso Store 5|AddMember|Owner| -|Morgan Conners|morganc@contoso.com|Contoso Store 6|AddMember|Member| -|Oscar Ward|oscarw@contoso.com|Contoso Store 7|AddMember|Member| -|Rene Pelletier|renep@contoso.com|Contoso Store 8|AddMember|Member| -|Sydney Mattos|sydneym@contoso.com|Contoso Store 9|AddMember|Member| -|Violet Martinez|violetm@contoso.com|Contoso Store 10|AddMember|Member| +|Avery Howard|averyh@contoso.com|Contoso Store 1|`AddMember`|`Owner`| +|Casey Jensen|caseyj@contoso.com|Contoso Store 2|`AddMember`|`Owner`| +|Jessie Irwin|jessiei@contoso.com|Contoso Store 3|`AddMember`|`Owner`| +|Manjeet Bhatia|manjeetb@contoso.com|Contoso Store 4|`AddMember`|`Owner`| +|Mikaela Lee|mikaelal@contoso.com|Contoso Store 5|`AddMember`|`Owner`| +|Morgan Conners|morganc@contoso.com|Contoso Store 6|`AddMember`|`Member`| +|Oscar Ward|oscarw@contoso.com|Contoso Store 7|`AddMember`|`Member`| +|Rene Pelletier|renep@contoso.com|Contoso Store 8|`AddMember`|`Member`| +|Sydney Mattos|sydneym@contoso.com|Contoso Store 9|`AddMember`|`Member`| +|Violet Martinez|violetm@contoso.com|Contoso Store 10|`AddMember`|`Member`| ### Step 2: Set up your environment |
| security | Compare Mdb M365 Plans | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/compare-mdb-m365-plans.md | Title: Compare security features in Microsoft 365 plans for small and medium-sized businesses -description: How does Defender for Business compare to Defender for Endpoint and Microsoft 365 Business Premium? See what's included in each plan so you can make a more informed decision for your company. +description: Learn about security plans available for small and medium-sized businesses. search.appverid: MET150 f1.keywords: NOCSH # Compare security features in Microsoft 365 plans for small and medium-sized businesses +Microsoft offers a wide variety of cloud solutions and services, including plans for small and medium-sized businesses. For example, [Microsoft 365 Business Premium](../../business/microsoft-365-business-overview.md) includes security and device-management capabilities, along with productivity features such as Office apps. This article describes the security features in Microsoft 365 Business Premium, Microsoft Defender for Business, and [Microsoft Defender for Endpoint](../defender-endpoint/microsoft-defender-endpoint.md). + > [!IMPORTANT] > This article provides a high-level overview of features and capabilities that are included in Microsoft Defender for Business (as a standalone plan) and Microsoft 365 Business Premium (which includes Defender for Business). It's not intended to be a service description or licensing contract document. For more detailed information, see the following resources: > - [Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance) > - [Microsoft 365 Education](/office365/servicedescriptions/office-365-platform-service-description/microsoft-365-education) -Microsoft offers a wide variety of cloud solutions and services, including plans for small and medium-sized businesses. For example, [Microsoft 365 Business Premium](../../business/microsoft-365-business-overview.md) includes security and device-management capabilities, along with productivity features such as Office apps. This article describes the security features in Microsoft 365 Business Premium, Microsoft Defender for Business, and [Microsoft Defender for Endpoint](../defender-endpoint/microsoft-defender-endpoint.md). - **Use this article to**: Microsoft offers a wide variety of cloud solutions and services, including plans - [Compare Defender for Business (standalone) to Defender for Endpoint Plan 1 and Plan 2](#compare-defender-for-business-to-defender-for-endpoint-plan-1-and-plan-2). > [!TIP]-> Defender for Business is available as a standalone security solution for small and medium-sized businesses. Defender for Business is also included in Microsoft 365 Business Premium, along with additional security capabilities. -> If you already have Microsoft 365 Business Basic or Standard, consider either upgrading to Microsoft 365 Business Premium or adding Defender for Business to your current subscription to get more threat protection capabilities for your organization. +> Defender for Business is available as a standalone security solution for small and medium-sized businesses. Defender for Business is also included in Microsoft 365 Business Premium, along with additional security capabilities. If you already have Microsoft 365 Business Basic or Standard, consider either upgrading to Microsoft 365 Business Premium or adding Defender for Business to your current subscription to get more threat protection capabilities for your organization. ## Compare Defender for Business to Microsoft 365 Business Premium The following table summarizes what's included in each plan: | [Windows Autopilot](/mem/autopilot/windows-autopilot) (for setting up and configuring Windows devices for first use) | | :::image type="icon" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: | | [Exchange Online Protection](../office-365-security/eop-about.md) (antiphishing, antispam, antimalware, and spoof intelligence for email) | | :::image type="icon" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: | | [Microsoft Defender for Office 365 Plan 1](/microsoft-365/security/office-365-security/defender-for-office-365) (advanced antiphishing, real-time detections, Safe Attachments, and Safe Links) | | :::image type="icon" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: |-| [Auto-expanding archiving](../../compliance/autoexpanding-archiving.md) (for email) | | :::image type="icon" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: | +| [Autoexpanding archiving](../../compliance/autoexpanding-archiving.md) (for email) | | :::image type="icon" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: | | [Azure Information Protection Premium Plan 1](/azure/information-protection/what-is-information-protection) (protection for sensitive information) | | :::image type="icon" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: | | [Azure Virtual Desktop](/azure/virtual-desktop/overview) (centrally managed, secure virtual machines in the cloud) | | :::image type="icon" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: | Defender for Business brings the enterprise-grade capabilities of Defender for E - [See the requirements for Microsoft Defender for Business](mdb-requirements.md) - [Get Microsoft Defender for Business](get-defender-business.md) - [Learn how to set up and configure Microsoft Defender for Business](mdb-setup-configuration.md)+- [Learn more about Microsoft 365 Business Premium](../../business-premium/index.md) |
| security | Get Defender Business | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/get-defender-business.md | Sections include: - **[How to get Defender for Business](#how-to-get-microsoft-defender-for-business)** to protect client devices, such as computers, tablets, and phones - **[How get Microsoft Defender for Business servers](#how-to-get-microsoft-defender-for-business-servers)**, an add-on that enables you to onboard and protect Windows and Linux servers-- **[Portals that you'll use](#portals-youll-use-for-setup-and-management)** to set up, configure, and manage Defender for Business+- **[Portals that you use](#portals-you-use-for-setup-and-management)** to set up, configure, and manage Defender for Business - **[Next steps](#next-step)**, such as adding users and assigning licenses. > [!IMPORTANT] Defender for Business provides advanced security protection for your company's d 2. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), and either sign in using your existing work or school account, or follow the prompts to create a new account. -3. In the [Microsoft 365 Defender portal](https://security.microsoft.com), in the navigation bar, go to **Assets** > **Devices**. This action initiates the provisioning of Defender for Business for your tenant. You'll know this process has started when you see a message like what's displayed in the following screenshot: +3. In the [Microsoft 365 Defender portal](https://security.microsoft.com), in the navigation bar, go to **Assets** > **Devices**. This action initiates the provisioning of Defender for Business for your tenant. You know this process has started when you see a message like what's displayed in the following screenshot: :::image type="content" source="media/mdb-hangon-provisioning.png" alt-text="Screenshot of provisioning message in Defender for Business."::: Microsoft 365 Business Premium includes Defender for Business, Microsoft Defende 3. After you've signed up for Microsoft 365 Business Premium, you'll receive an email with a link to sign in and get started. Proceed to [Set up Microsoft 365 Business Premium](../../business-premium/m365-business-premium-setup.md). -4. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), where you'll view and manage security settings and devices for your organization. In the navigation bar, go to **Assets** > **Devices**. This action initiates the provisioning of Defender for Business for your tenant. +4. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), where you view and manage security settings and devices for your organization. In the navigation bar, go to **Assets** > **Devices**. This action initiates the provisioning of Defender for Business for your tenant. 5. Follow the guidance in [Boost your security protection](../../business-premium/m365bp-security-overview.md) to set up your security capabilities. Microsoft Defender for Business servers is an add-on to Defender for Business th 3. In the list of results, select the **Details** box for **Microsoft Defender for Business servers**. -4. Review the information, and complete the purchase process. You'll need one Microsoft Defender for Business servers license for each instance of Windows Server or Linux, and you won't assign that license to users or devices. +4. Review the information, and complete the purchase process. You need one Microsoft Defender for Business servers license for each instance of Windows Server or Linux, and you don't assign that license to users or devices. > [!IMPORTANT] > - In order to add on Microsoft Defender for Business servers, you'll need at least one paid license for [Defender for Business](mdb-overview.md) (standalone) or [Microsoft 365 Business Premium](../../business-premium/index.md). Microsoft Defender for Business servers is an add-on to Defender for Business th > - If preferred, you could use [Microsoft Defender for Servers Plan 1 or Plan 2](/azure/defender-for-cloud/plan-defender-for-servers) instead to onboard your servers. To learn more, see [What happens if I have a mix of Microsoft endpoint security subscriptions](mdb-faq.yml#what-happens-if-i-have-a-mix-of-microsoft-endpoint-security-subscriptions)? -## Portals you'll use for setup and management +## Portals you use for setup and management -When you use Defender for Business, you'll work with two main portals: the Microsoft 365 admin center, and the Microsoft 365 Defender portal. If your subscription also includes Microsoft Intune, you'll use the Intune admin center as well. The following table summarizes these portals and how you'll use them. +When you use Defender for Business, you work with two main portals: ++- The Microsoft 365 admin center ([https://admin.microsoft.com](https://admin.microsoft.com)) +- The Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) ++If your subscription also includes Microsoft Intune, you use the Intune admin center ([https://intune.microsoft.com](https://intune.microsoft.com)) as well. The following table summarizes these portals and how you use them. |Portal |Description | |||-| The Microsoft 365 admin center ([https://admin.microsoft.com/](https://admin.microsoft.com/)) | Use the Microsoft 365 admin center to activate your trial and sign in for the first time. You'll also use the Microsoft 365 admin center to: <br/>- Add or remove users.<br/>- Assign user licenses.<br/>- View your products and services.<br/>- Complete setup tasks for your Microsoft 365 subscription.<br/><br/>To learn more, see [Overview of the Microsoft 365 admin center](../../admin/admin-overview/admin-center-overview.md). | -| The Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) | Use the Microsoft 365 Defender portal to set up and configure Defender for Business, and to monitor your devices and threat detections. You'll use the Microsoft 365 Defender portal to: <br/>- View your devices and device protection policies.<br/>- View detected threats and take action.<br/>- View security recommendations and manage your security settings.<br/><br/>To learn more, see [Get started using the Microsoft 365 Defender portal](mdb-get-started.md). | +| The Microsoft 365 admin center ([https://admin.microsoft.com/](https://admin.microsoft.com/)) | Use the Microsoft 365 admin center to activate your trial and sign in for the first time. You can also use the Microsoft 365 admin center to: <br/>- Add or remove users.<br/>- Assign user licenses.<br/>- View your products and services.<br/>- Complete setup tasks for your Microsoft 365 subscription.<br/><br/>To learn more, see [Overview of the Microsoft 365 admin center](../../admin/admin-overview/admin-center-overview.md). | +| The Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) | Use the Microsoft 365 Defender portal to set up and configure Defender for Business, and to monitor your devices and threat detections. You use the Microsoft 365 Defender portal to: <br/>- View your devices and device protection policies.<br/>- View detected threats and take action.<br/>- View security recommendations and manage your security settings.<br/><br/>To learn more, see [Get started using the Microsoft 365 Defender portal](mdb-get-started.md). | | The Intune admin center ([https://intune.microsoft.com/](https://intune.microsoft.com/)) | Use the Intune admin center to set up multifactor authentication (MFA), onboard iOS and Android devices, and configure certain capabilities, such as [attack surface reduction rules](mdb-asr.md).<br/><br/>To learn more about Intune, see [Microsoft Intune is an MDM and MAM provider for your devices](/mem/intune/fundamentals/what-is-intune). | ## Next step |
| security | Mdb Get Help | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-get-help.md | +- tier3 search.appverid: MET150 description: Get help or contact support if you have any issues with Defender for Business. |
| security | Mdb Get Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-get-started.md | Use the navigation bar on the left side of the screen to access your incidents, | Item | Description | |:|:| | **Home** | Takes you to your home page in the Microsoft 365 Defender portal. The home page highlights any active threats that are detected, along with recommendations to help secure your company's data and devices. Recommendations are included in Defender for Business to save your security team time and effort. The recommendations are based on industry best practices. To learn more, see [Security recommendations - Microsoft Defender Vulnerability Management](../defender-endpoint/tvm-security-recommendation.md). |-| **Incidents** | Takes you to your list of recent incidents. As alerts are triggered, incidents are created. An incident can include multiple alerts. Make sure to review your incidents regularly. To learn more, see [View and manage incidents in Defender for Business](mdb-view-manage-incidents.md).| +| **Incidents & alerts** > **Incidents** | Takes you to your list of recent incidents. As alerts are triggered, incidents are created. An incident can include multiple alerts. Make sure to review your incidents regularly. To learn more, see [View and manage incidents in Defender for Business](mdb-view-manage-incidents.md).| | **Actions & submissions** > **Action center** | Takes you to your list of response actions, including completed and pending actions.<br/>- Select the **Pending** tab to view actions that require approval to proceed.<br/>- Select the **History** tab to see the actions that were taken. Some actions are taken automatically; others are taken manually or complete after they're approved.<br/><br/>To learn more, see [Review remediation actions in the Action center](mdb-review-remediation-actions.md). | | **Actions & submissions** > **Submissions** | Takes you to the unified submissions portal, where you can submit files to Microsoft for analysis. To learn more, see [Submit files in Microsoft Defender for Endpoint](../defender-endpoint/admin-submissions-mde.md) (the process is similar for Defender for Business). |-| **Threat analytics** | Takes you to a view of current threats, and provides an at-a-glance view of your threat landscape. Threat analytics also includes reports and information from Microsoft security researchers. To learn more, see [Track and respond to emerging threats through threat analytics](../defender-endpoint/threat-analytics.md). | | **Secure score** | Provides a representation of your company's security position and offers suggestions to improve it. To learn more, see [Microsoft Secure Score for Devices](../defender-endpoint/tvm-microsoft-secure-score-devices.md). | | **Learning hub** | Provides access to security training and other resources through learning paths that are included with your subscription. You can filter by product, skill level, role, and more. The Learning hub can help your security team ramp up on security features and capabilities in Defender for Business and more Microsoft offerings, such as [Microsoft Defender for Endpoint](../defender-endpoint/microsoft-defender-endpoint.md) and [Microsoft Defender for Office 365](../office-365-security/defender-for-office-365.md). | | **Trials** | Try additional security and compliance capabilities by adding on a trial subscription. If you do not see **Trials** in your navigation bar, and you want to add on another trial, you can take one of the following steps: <br/>- Visit the [Small Business Solutions page](https://www.microsoft.com/en-us/store/b/business?icid=CNavBusinessStore), and choose **Questions? Talk to an expert** to get some help adding on a trial subscription. <br/>- Go to the [Microsoft 365 admin center](https://admin.microsoft.com/?auth_upn=admin%40M365B614031.onmicrosoft.com&source=applauncher#/catalog), and choose **Billing** > **Purchase services**. If you need help, choose **Help & support**. |+| **Partner catalog** | Lists Microsoft partners who provide technical and professional services. | | **Assets** > **Devices** | Enables you to view devices, such as computers and mobile devices that are enrolled in [Microsoft Intune](/mem/intune/fundamentals/what-is-intune). | | **Endpoints** > **Vulnerability management** | Enables you to access your [Microsoft Defender Vulnerability Management](../defender-vulnerability-management/defender-vulnerability-management.md) capabilities. Provides a dashboard, recommendations, remediation activities, a software inventory, and a list of potential weaknesses within your company. | | **Endpoints** > **Tutorials** | Provides access to walkthroughs and simulations to help you learn more about how your threat protection features work. Select the **Read the walkthrough** link before attempting to get the simulation file for each tutorial. Some simulations require Office apps, such as Microsoft Word, to read the walkthrough. | |
| security | Mdb Respond Mitigate Threats | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-respond-mitigate-threats.md | -2. Notice cards on the Home page. Cards tell you at a glance how many threats were detected, along with how many user accounts, endpoints (devices), and other assets were affected. The following image is an example of cards you might see: +2. Notice cards on the Home page. These cards were designed to tell you at a glance how many threats were detected, how many user accounts, and what endpoints (devices) or other assets were affected. The following image is an example of cards you might see: :::image type="content" source="../../medib-examplecards.png" alt-text="Screenshot of cards in the Microsoft 365 Defender portal"::: |
| security | Mdb View Manage Incidents | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-view-manage-incidents.md | -As threats are detected and alerts are triggered, incidents are created. Your company's security team can view and manage incidents in the Microsoft 365 Defender portal. +As threats are detected and alerts are triggered, incidents are created. Your company's security team can view and manage incidents in the Microsoft 365 Defender portal. You must have appropriate permissions assigned to perform the tasks in this article. See [Security roles and permissions in Microsoft Defender for Business](mdb-roles-permissions.md). **This article includes**: As threats are detected and alerts are triggered, incidents are created. Your co ## Monitor your incidents & alerts -1. In the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), in the navigation pane, select **Incidents**. Any incidents that were created are listed on the page. -- :::image type="content" source="../../medib-incidents-list.png" alt-text="Screenshot of the Incidents list"::: +1. In the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), in the navigation pane, go to **Incidents & alerts**, and then select **Incidents**. Any incidents that were created are listed on the page. 2. Select an alert to open its flyout pane, where you can learn more about the alert. As threats are detected and alerts are triggered, incidents are created. Your co 3. In the flyout pane, you can see the alert title, view a list of assets (such as endpoints or user accounts) that were affected, take available actions, and use links to view more information and even open the details page for the selected alert. > [!TIP]-> Defender for Business is designed to help you address detected threats by offering up recommended actions. When you view an alert, look for the recommended actions to take. Also take note of the alert severity, which is determined not only on the basis of the threat severity, but also on the level of risk to your company. +> Defender for Business is designed to help you address detected threats by recommeding actions you can take. When you view an alert, look for these suggestions. Also notice the alert severity, which is determined not only on the basis of the detected threat severity, but also on the level of risk to your company. ## Alert severity -When Microsoft Defender Antivirus assigns an alert severity based on the absolute severity of a detected threat (malware) and the potential risk to an individual endpoint (if infected). Defender for Business assigns an alert severity based on the severity of the detected behavior, the actual risk to an endpoint (device), and more importantly, the potential risk to your company. The following table lists a few examples: +When a threat is detected, a severity level is assigned to each alert that is generated. ++- Microsoft Defender Antivirus assigns an alert severity based on the absolute severity of a detected threat (such as malware) and the potential risk to an individual endpoint (if infected). +- Defender for Business assigns an alert severity based on the severity of the detected behavior, the actual risk to an endpoint (device), and more importantly, the potential risk to your company. ++The following table lists a few examples of alerts and their severity levels: | Scenario | Alert severity and reason | |:|:| |
| security | Application Deployment Via Mecm | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/application-deployment-via-mecm.md | ms.sitesec: library ms.pagetype: security-+ ms.localizationpriority: medium |
| security | Ios Configure Features | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/ios-configure-features.md | Follow the below steps for setting up MAM config for unenrolled devices for Netw |Key| Default (true - enable, false - disable)|Description| ||||- |`DefenderOpenNetworkDetection`|0|1 - enable, 0 - disable, 2 - Enable. This setting is managed by an IT Admin to enable, audit, or disable open network detection. In Audit mode, alerts will be sent only to the ATP portal with no user side experience. For user experience, set the config to "Enable" mode.| + |`DefenderOpenNetworkDetection`|0| 1 - Audit, 0 - Disable (default), 2 - Enable. This setting is managed by an IT admin to enable, audit, or disable open network detection. In Audit mode, alerts will be sent only to the ATP portal with no user side experience. For user experience, set the config to "Enable" mode.| |`DefenderEndUserTrustFlowEnable`| false | true - enable, false - disable; This setting is used by IT admins to enable or disable the end user in-app experience to trust and untrust the unsecure and suspicious networks.| |`DefenderNetworkProtectionAutoRemediation`| true |true - enable, false - disable; This setting is used by the IT admin to enable or disable the remediation alerts that are sent when a user performs remediation activities like switching to safer WIFI access points or deleting suspicious certificates detected by Defender.| |`DefenderNetworkProtectionPrivacy`| true |true - enable, false - disable; This setting is managed by IT admin to enable or disable privacy in network protection.| |
| security | Ios Install | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/ios-install.md | Configure the supervised mode for Defender for Endpoint app through an App confi 1. In the next screen, select **Use configuration designer** as the format. Specify the following properties: - Configuration Key: `issupervised` - Value type: String- - Configuration Value: `true` + - Configuration Value: `{{issupervised}}` :::image type="content" source="images/ios-deploy-6.png" alt-text="Image of Microsoft Intune admin center6." lightbox="images/ios-deploy-6.png"::: |
| security | Linux Deploy Defender For Endpoint With Chef | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-deploy-defender-for-endpoint-with-chef.md | ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -+ ms.localizationpriority: medium audience: ITPro |
| security | Mac Install With Other Mdm | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-install-with-other-mdm.md | ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -+ ms.localizationpriority: medium audience: ITPro |
| security | Migrating Asr Rules | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/migrating-asr-rules.md | ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro-+ |
| security | Migrating Mde Server To Cloud | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/migrating-mde-server-to-cloud.md | Title: Migrating servers from Microsoft Defender for Endpoint to Microsoft Defender for Cloud description: Learn how to migrate servers from Microsoft Defender for Endpoint to Microsoft Defender for Cloud. keywords: migrate server, server, Microsoft Defender for Endpoint server, Microsoft Defender for Cloud, MDE, azure, azure cloud, CSPM, CWP, cloud workload protection, threat protection, advanced threat protection, Microsoft Azure, multi-cloud connector-+ audience: ITPro |
| security | Minimum Requirements | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/minimum-requirements.md | Devices on your network must be running one of these editions. New features or c > [!NOTE] > You'll need to confirm the Linux distributions and versions of Android, iOS, and macOS are compatible with Defender for Endpoint.-> - *While Windows 10 IoT Enterprise is a supported OS in Microsoft Defender for Endpoint and enables OEMs/ODMs to distribute it as part of their product or solution, customers should follow the OEM/ODM's guidance around host-based installed software and supportability. -> - **Requires the use of the [Log Analytics](/azure/azure-monitor/agents/log-analytics-agent) / Microsoft Monitoring Agent (MMA) +> - While Windows 10 IoT Enterprise is a supported OS in Microsoft Defender for Endpoint and enables OEMs/ODMs to distribute it as part of their product or solution, customers should follow the OEM/ODM's guidance around host-based installed software and supportability. +> - Requires the use of the [Log Analytics](/azure/azure-monitor/agents/log-analytics-agent)/Microsoft Monitoring Agent (MMA). > - Endpoints running mobile versions of Windows (such as Windows CE and Windows 10 Mobile) aren't supported. > - Virtual Machines running Windows 10 Enterprise 2016 LTSB may encounter performance issues if run on non-Microsoft virtualization platforms. > - For virtual environments, we recommend using Windows 10 Enterprise LTSC 2019 or later. |
| security | Tamperprotection Macos | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/tamperprotection-macos.md | Configure tamper protection mode in Microsoft Defender for Endpoint [configurati > If you already have a configuration profile for Microsoft Defender for Endpoint then you need to *add* settings to it. You should not create a second configuration profile. ### Intune+#### Settings catalog +You can create a new settings catalog profile to add the Tamper protection configuration, or you can add it to an existing one. The setting "Enforcement level" can be found under category "Microsoft Defender" and subcategory "Tamper protection". Afterwards, choose the desired level. -Follow the documented Intune profile example to configure Tamper Protection through Intune. For more information, see [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md). --Add the following configuration in your Intune profile: +#### Custom profile +As an alternative, you can also configure Tamper protection via a custom profile. For more information, see [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md). > [!NOTE]-> For Intune configuration, you can create a new profile configuration file to add the Tamper protection configuration, or you can add these parameters to the existing one. +> For Intune configuration, you can create a new profile configuration file to add the Tamper protection configuration, or you can add these parameters to the existing one. Choose the desired level. ```xml <?xml version="1.0" encoding="utf-8"?> Add the following configuration in your Intune profile: </dict> </plist> ```-+#### Check status Check the tamper protection status by running the following command: `mdatp health --field tamper_protection` |
| security | Technological Partners | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/technological-partners.md | |
| security | Troubleshoot Cloud Connect Mdemac | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-cloud-connect-mdemac.md | ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -+ ms.localizationpriority: medium audience: ITPro |
| security | Web Content Filtering | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/web-content-filtering.md | Before trying out this feature, make sure you meet the requirements described in | Subscription | Your subscription must include one of the following:<br/>- [Windows 10/11 Enterprise E5](/windows/deployment/deploy-enterprise-licenses)<br/>- [Microsoft 365 E5](https://www.microsoft.com/microsoft-365/enterprise/e5?activetab=pivot%3aoverviewtab)<br/>- Microsoft 365 A5<br/>- Microsoft 365 E5 Security<br/>- [Microsoft 365 E3](https://www.microsoft.com/microsoft-365/enterprise/e3?activetab=pivot%3aoverviewtab)<br/>- [Microsoft Defender for Endpoint Plan 1 or Plan 2](../defender/eval-defender-endpoint-overview.md)<br/>- [Microsoft Defender for Business](../defender-business/mdb-overview.md)<br/>- [Microsoft 365 Business Premium](https://www.microsoft.com/microsoft-365/business/microsoft-365-business-premium)| | Portal access | You must have access to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. | | Operating system | Your organization's devices must be running one of the following operating systems with the [latest antivirus/antimalware updates](microsoft-defender-antivirus-updates.md): <br/>- Windows 11<br/>- Windows 10 Anniversary Update (version 1607) or later <br/>- For information on MacOS availability, see [Network Protection for MacOS](network-protection-macos.md)<br/>- For information on Linux availability, see [Network Protection for Linux](network-protection-linux.md)|+| Browser | Your organization's devices must be running one of the following browsers: <br/>- Microsoft Edge<br/>- Google Chrome<br/>- Mozilla FireFox<br/>- Brave<br/>- Opera<br/>- Internet Explorer| | Related protection | [Windows Defender SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview) and [network protection](network-protection.md) must be enabled on your organization's devices. | ## Data handling Web content filtering policies specify which site categories are blocked on whic Policies can be deployed to block any of the following parent or child categories: -<details> -<summary>Adult content</summary> +| Parent category | Child categories | +||| +| **Adult content** | - **Cults**: Sites related to groups or movements whose members demonstrate passion for a belief system that is different from those that are socially accepted.<br/><br/>- **Gambling**: Online gambling and sites that promote gambling skills and practice.<br/><br/>- **Nudity**: Sites that provide full-frontal and semi-nude images or videos, typically in artistic form, and might allow the download or sale of such materials.<br/><br/>- **Pornography / Sexually explicit**: Sites containing sexually explicit content in an image-based or textual form. Any form of sexually oriented material is also listed here.<br/><br/>- **Sex education**: Sites that discuss sex and sexuality in an informative and non-voyeuristic way, including sites that provide education about human reproduction and contraception, sites that offer advice on preventing infection from sexual diseases, and sites that offer advice on sexual health matters.<br/><br/>- **Tasteless**: Sites oriented towards content unsuitable for school children to view or that an employer would be uncomfortable with their staff accessing, but not necessarily violent or pornographic.<br/><br/>- **Violence**: Sites that display or promote content related to violence against humans or animals. | +| **High bandwidth** | - **Download sites**: Sites whose primary function is to allow users to download media content or programs, such as computer programs.<br/><br/>- **Image sharing**: Sites that are used primarily for searching or sharing photos, including those that have social aspects.<br/><br/>- **Peer-to-peer**: Sites that host peer-to-peer (P2P) software or facilitate the sharing of files using P2P software.<br/><br/>- **Streaming media & downloads**: Sites whose primary function is the distribution of streaming media, or sites that allow users to search, watch, or listen to streaming media. | +| **Legal liability** | - **Child abuse images**: Sites that include child abuse images or pornography.<br/><br/>- **Criminal activity**: Sites that give instruction on, advice about, or promotion of illegal activities.<br/><br/>- **Hacking**: Sites that provide resources for illegal or questionable use of computer software or hardware, including sites that distribute copyrighted material that has been cracked.<br/><br/>- **Hate & intolerance**: Sites promoting aggressive, degrading, or abusive opinions about any section of the population that could be identified by race, religion, gender, age, nationality, physical disability, economic situation, sexual preferences or any other lifestyle choice.<br/><br/>- **Illegal drug**: Sites that sell illegal/controlled substances, promote substance abuse, or sell related paraphernalia.<br/><br/>- **Illegal software**: Sites that contain or promote the use of malware, spyware, botnets, phishing scams, or piracy & copyright theft.<br/><br/>- **School cheating**: Sites related to plagiarism or school cheating.<br/><br/>- **Self-harm**: Sites that promote self-harm, including cyberbullying sites that contain abusive and/or threatening messages towards users.<br/><br/>- **Weapons**: Any site that sells weapons or advocates the use of weapons, including but not limited to guns, knives, and ammunition. | +| **Leisure** | - **Chat**: Sites that are primarily web-based chat rooms.<br/><br/>- **Games**: Sites relating to video or computer games, including sites that promote gaming through hosting online services or information related to gaming.<br/><br/>- **Instant messaging**: Sites that can be used to download instant messaging software or client based instant messaging.<br/><br/>- **Professional network**: Sites that provide professional networking services.<br/><br/>- **Social networking**: Sites that provide social networking services.<br/><br/>- **Web-based email**: Sites offering web-based mail services. | +| **Uncategorized** | - **Newly registered domains**: Sites that have been newly registered in the past 30 days and have not yet been moved to another category.<br/><br/>- **Parked domains**: Sites that have no content or are parked for later use. | -**Cults**: Sites related to groups or movements whose members demonstrate passion for a belief system that is different from those that are socially accepted. --**Gambling**: Online gambling and sites that promote gambling skills and practice. --**Nudity**: Sites that provide full-frontal and semi-nude images or videos, typically in artistic form, and might allow the download or sale of such materials. --**Pornography / Sexually explicit**: Sites containing sexually explicit content in an image-based or textual form. Any form of sexually oriented material is also listed here. --**Sex education**: Sites that discuss sex and sexuality in an informative and non-voyeuristic way, including sites that provide education about human reproduction and contraception, sites that offer advice on preventing infection from sexual diseases, and sites that offer advice on sexual health matters. --**Tasteless**: Sites oriented towards content unsuitable for school children to view or that an employer would be uncomfortable with their staff accessing, but not necessarily violent or pornographic. --**Violence**: Sites that display or promote content related to violence against humans or animals. --</details> --<details> -<summary>High bandwidth</summary> --**Download sites**: Sites whose primary function is to allow users to download media content or programs, such as computer programs. --**Image sharing**: Sites that are used primarily for searching or sharing photos, including those that have social aspects. --**Peer-to-peer**: Sites that host peer-to-peer (P2P) software or facilitate the sharing of files using P2P software. --**Streaming media & downloads**: Sites whose primary function is the distribution of streaming media, or sites that allow users to search, watch, or listen to streaming media. --</details> --<details> -<summary>Legal liability</summary> --**Child abuse images**: Sites that include child abuse images or pornography. --**Criminal activity**: Sites that give instruction on, advice about, or promotion of illegal activities. --**Hacking**: Sites that provide resources for illegal or questionable use of computer software or hardware, including sites that distribute copyrighted material that has been cracked. --**Hate & intolerance**: Sites promoting aggressive, degrading, or abusive opinions about any section of the population that could be identified by race, religion, gender, age, nationality, physical disability, economic situation, sexual preferences or any other lifestyle choice. --**Illegal drug**: Sites that sell illegal/controlled substances, promote substance abuse, or sell related paraphernalia. --**Illegal software**: Sites that contain or promote the use of malware, spyware, botnets, phishing scams, or piracy & copyright theft. --**School cheating**: Sites related to plagiarism or school cheating. --**Self-harm**: Sites that promote self-harm, including cyberbullying sites that contain abusive and/or threatening messages towards users. --**Weapons**: Any site that sells weapons or advocates the use of weapons, including but not limited to guns, knives, and ammunition. --</details> --<details> -<summary>Leisure</summary> --**Chat**: Sites that are primarily web-based chat rooms. --**Games**: Sites relating to video or computer games, including sites that promote gaming through hosting online services or information related to gaming. --**Instant messaging**: Sites that can be used to download instant messaging software or client based instant messaging. --**Professional network**: Sites that provide professional networking services. --**Social networking**: Sites that provide social networking services. --**Web-based email**: Sites offering web-based mail services. --</details> --<details> -<summary>Uncategorized</summary> --**Newly registered domains**: Sites that have been newly registered in the past 30 days and have not yet been moved to another category. --**Parked domains**: Sites that have no content or are parked for later use. --**NOTE**: Uncategorized contains only newly registered domains and parked domains, and does not include all other sites outside of these categories. --</details> +> [!NOTE] +> Uncategorized contains only newly registered domains and parked domains, and does not include all other sites outside of these categories. ### Create a policy To add a new policy, follow these steps: 5. Review the summary and save the policy. > [!NOTE]-> - There may be up to 2 hours of latency between the time a policy is created and the policy being enforced on the device. -> - You can deploy a policy without selecting any category on a device group. This action will create an audit only policy to help you understand user behavior before creating a block policy. -> - If you are removing a policy or changing device groups at the same time, this might cause a delay in policy deployment. +> - There might be up to 2 hours of latency between the time a policy is created and when it's enforced on the device. +> - You can deploy a policy without selecting any category on a device group. This action creates an audit-only policy to help you understand user behavior before creating a block policy. +> - If you are removing a policy or changing device groups at the same time, there could be a delay in policy deployment. > - Blocking the "Uncategorized" category could lead to unexpected and undesired results. ## End-user experience If you encounter a domain that has been incorrectly categorized, you can dispute To dispute the category of a domain, navigate to **Reports** \> **Web protection** \> **Web Content Filtering Details** \> **Domains**. On the domains tab of the Web Content Filtering reports, you will see an ellipsis beside each of the domains. Hover over this ellipsis and select **Dispute Category**. -A panel will open where you can select the priority and add more details such as the suggested category for recategorization. Once you complete the form, select **Submit**. Our team will review the request within one business day. For immediate unblocking, create a [custom allow indicator](indicator-ip-domain.md). +A panel opens where you can select the priority and add more details such as the suggested category for recategorization. Once you complete the form, select **Submit**. Our team will review the request within one business day. For immediate unblocking, create a [custom allow indicator](indicator-ip-domain.md). ## Web content filtering cards and details |
| security | Whats New In Microsoft Defender Endpoint | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint.md | For more information on Microsoft Defender for Endpoint on specific operating sy - [What's new in Defender for Endpoint on Windows](windows-whatsnew.md) - [What's new in Defender for Endpoint on macOS](mac-whatsnew.md)-- [What's new in Defender for Endpoint on iOS](ios-whatsnew.md) - [What's new in Defender for Endpoint on Linux](linux-whatsnew.md)+- [What's new in Defender for Endpoint on Android](android-whatsnew.md) +- [What's new in Defender for Endpoint on iOS](ios-whatsnew.md) + ## August 2023 |
| security | Api Create App User Context | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-create-app-user-context.md | $AppClientId="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" # Paste your application (cl $MsalParams = @{ ClientId = $AppClientId TenantId = $TenantId- Scopes = 'https://graph.microsoft.com/User.Read.All','https://graph.microsoft.com/Files.ReadWrite' + Scopes = 'https://graph.microsoft.com/User.Read.All','https://graph.microsoft.com/Files.ReadWrite','https://api.securitycenter.windows.com/AdvancedQuery.Read' } $MsalResponse = Get-MsalToken @MsalParams |
| security | Device Profile | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/device-profile.md | |
| security | Eval Defender Office 365 Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-office-365-overview.md | ms.pagetype: security f1.keywords: - NOCSH -+ ms.localizationpriority: medium audience: ITPro |
| security | Setup M365deval | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/setup-m365deval.md | ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -+ ms.localizationpriority: medium audience: ITPro |
| security | Anti Malware Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-malware-policies-configure.md | You can configure anti-malware policies in the Microsoft 365 Defender portal or - **Groups**: - Members of the specified distribution groups or mail-enabled security groups (dynamic distribution groups aren't supported). - The specified Microsoft 365 Groups.- - **Domains**: All recipients in the specified [accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) in your organization. + - **Domains**: All recipients in the organization with a primary email address in the specified [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains). Click in the appropriate box, start typing a value, and select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, select :::image type="icon" source="../../media/m365-cc-sc-remove-selection-icon.png" border="false"::: next to the value. |
| security | Anti Phishing Policies About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-policies-about.md | The following policy settings are available in anti-phishing policies in EOP and - **Groups**: - Members of the specified distribution groups or mail-enabled security groups (dynamic distribution groups aren't supported). - The specified Microsoft 365 Groups.- - **Domains**: One or more of the configured [accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) in Microsoft 365. + - **Domains**: One or more of the configured [accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) in Microsoft 365. The recipient's primary email address is in the specified domain. - **Exclude these users, groups, and domains**: Exceptions for the policy. The settings and behavior are exactly like the conditions: - **Users** |
| security | Anti Phishing Policies Eop Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-policies-eop-configure.md | For anti-phishing policy procedures in organizations with Microsoft Defender for - **Groups**: - Members of the specified distribution groups or mail-enabled security groups (dynamic distribution groups aren't supported). - The specified Microsoft 365 Groups.- - **Domains**: All recipients in the specified [accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) in your organization. + - **Domains**: All recipients in the organization with a primary email address in the specified [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains). Click in the appropriate box, start typing a value, and select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, select :::image type="icon" source="../../media/m365-cc-sc-remove-selection-icon.png" border="false"::: next to the value. |
| security | Anti Phishing Policies Mdo Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure.md | For anti-phishing policy procedures in organizations without Defender for Office - **Groups**: - Members of the specified distribution groups or mail-enabled security groups (dynamic distribution groups aren't supported). - The specified Microsoft 365 Groups.- - **Domains**: All recipients in the specified [accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) in your organization. + - **Domains**: All recipients in the organization with a primary email address in the specified [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains). Click in the appropriate box, start typing a value, and select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, select :::image type="icon" source="../../media/m365-cc-sc-remove-selection-icon.png" border="false"::: next to the value. |
| security | Anti Spam Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-spam-policies-configure.md | You can configure anti-spam policies in the Microsoft 365 Defender portal or in - **Groups**: - Members of the specified distribution groups or mail-enabled security groups (dynamic distribution groups aren't supported). - The specified Microsoft 365 Groups.- - **Domains**: All recipients in the specified [accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) in your organization. + - **Domains**: All recipients in the organization with a primary email address in the specified [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains). Click in the appropriate box, start typing a value, and then select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, select :::image type="icon" source="../../media/m365-cc-sc-remove-selection-icon.png" border="false"::: next to the value. |
| security | Detect And Remediate Outlook Rules Forms Attack | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/detect-and-remediate-outlook-rules-forms-attack.md | f1.keywords: Previously updated : 6/14/2023 Last updated : 9/7/2023 audience: ITPro appliesto: ## What is the Outlook Rules and Custom Forms injection attack? -After an attacker gains access to your organization, they'll try to establish a foothold to stay in or get back in after they've been discovered. This activity is called *establishing a persistence mechanism*. There are two ways that an attacker can use Outlook to establish a persistence mechanism: +After an attacker gains access to your organization, they try to establish a foothold to stay in or get back in after they're discovered. This activity is called *establishing a persistence mechanism*. There are two ways that an attacker can use Outlook to establish a persistence mechanism: - By exploiting Outlook rules. - By injecting custom forms into Outlook. -Reinstalling Outlook, or even giving the affected person a new computer won't help. When the fresh installation of Outlook connects to the mailbox, all rules and forms are synchronized from the cloud. The rules or forms are typically designed to run remote code and install malware on the local machine. The malware steals credentials or performs other illicit activity. +Reinstalling Outlook, or even giving the affected person a new computer doesn't help. When the fresh installation of Outlook connects to the mailbox, all rules and forms are synchronized from the cloud. The rules or forms are typically designed to run remote code and install malware on the local machine. The malware steals credentials or performs other illicit activity. -The good news is: if you keep your Outlook clients patched to the latest version, you aren't vulnerable to the threat as current Outlook client defaults block both mechanisms. +The good news is: if you keep Outlook clients patched to the latest version, you aren't vulnerable to the threat as current Outlook client defaults block both mechanisms. The attacks typically follow these patterns: **The Rules Exploit**: 1. The attacker steals a user's credentials.- 2. The attacker signs in to that user's Exchange mailbox (Exchange Online or on-premises Exchange).- 3. The attacker creates a forwarding Inbox rule in the mailbox. The forwarding rule is triggered when the mailbox receives a specific message from the attacker that matches the conditions of the rule. The rule conditions and message format are tailor-made for each other.- 4. The attacker sends the trigger email to the compromised mailbox, which is still being used as normal by the unsuspecting user.- 5. When the mailbox receives a message that matches the conditions of rule, the action of the rule is applied. Typically, the rule action is to launch an application on a remote (WebDAV) server.- 6. Typically, the application installs malware on the user's machine (for example, [PowerShell Empire](https://www.powershellempire.com/)).- 7. The malware allows the attacker to steal (or steal again) the user's username and password or other credentials from local machine and perform other malicious activities. **The Forms Exploit**: 1. The attacker steals a user's credentials.- 2. The attacker signs in to that user's Exchange mailbox (Exchange Online or on-premises Exchange).- 3. The attacker inserts a custom mail form template into the user's mailbox. The custom form is triggered when the mailbox receives a specific message from the attacker that requires the mailbox to load the custom form. The custom form and the message format are tailor-made for each other.- 4. The attacker sends the trigger email to the compromised mailbox, which is still being used as normal by the unsuspecting user.- 5. When the mailbox receives the message, the mailbox loads the required form. The form launches an application on a remote (WebDAV) server.- 6. Typically, the application installs malware on the user's machine (for example, [PowerShell Empire](https://www.powershellempire.com/)).- 7. The malware allows the attacker to steal (or steal again) the user's username and password or other credentials from local machine and perform other malicious activities. ## What a Rules and Custom Forms Injection attack might look like Office 365? -These persistence mechanisms are unlikely to be noticed by your users and may in some cases even be invisible to them. This article tells you how to look for any of the seven signs (Indicators of Compromise) listed below. If you find any of these, you need to take remediation steps. +Users are unlikely to notice these persistence mechanisms and they might even be invisible to them. The following list describes the signs (Indicators of Compromise) that indicate remediation steps are required: - **Indicators of the Rules compromise**: - Rule Action is to start an application. You can use either of the following methods to confirm the attack: - Manually examine the rules and forms for each mailbox using the Outlook client. This method is thorough, but you can only check one mailbox at a time. This method can be very time consuming if you have many users to check, and might also infect the computer that you're using. -- Use the [Get-AllTenantRulesAndForms.ps1](https://github.com/OfficeDev/O365-InvestigationTooling/blob/master/Get-AllTenantRulesAndForms.ps1) PowerShell script to automatically dump all the mail forwarding rules and custom forms for all the users in your tenancy. This is the fastest and safest method with the least amount of overhead.+- Use the [Get-AllTenantRulesAndForms.ps1](https://github.com/OfficeDev/O365-InvestigationTooling/blob/master/Get-AllTenantRulesAndForms.ps1) PowerShell script to automatically dump all the mail forwarding rules and custom forms for all the users in your organization. This method is the fastest and safest with the least amount of overhead. ++ > [!NOTE] + > As of January 2021, the script (and everything else in the repository) is read-only and archived. Lines 154 to 158 attempt to connect to Exchange Online PowerShell using a method that's no longer supported due to the [deprecation of remote PowerShell connections](https://techcommunity.microsoft.com/t5/exchange-team-blog/deprecation-of-remote-powershell-in-exchange-online-re-enabling/ba-p/3779692) in July 2023. Remove lines 154 to 158 and [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) before you run the script. ### Confirm the Rules Attack Using the Outlook client You can use either of the following methods to confirm the attack: 2. Follow the steps in, [Show the Developer tab](https://support.microsoft.com/office/e1192344-5e56-4d45-931b-e5fd9bea2d45) for the user's version of Outlook. -3. Open the now visible developer tab in Outlook and click **design a form**. +3. Open the now visible developer tab in Outlook and select **design a form**. 4. Select the **Inbox** from the **Look In** list. Look for any custom forms. Custom forms are rare enough that if you have any custom forms at all, it is worth a deeper look. -5. Investigate any custom forms, especially those marked as hidden. +5. Investigate any custom forms, especially forms marked as hidden. -6. Open any custom forms and in the **Form** group click **View Code** to see what runs when the form is loaded. +6. Open any custom forms and in the **Form** group, select **View Code** to see what runs when the form is loaded. ### Steps to confirm the Rules and Forms attack using PowerShell -The simplest way to verify a rules or custom forms attack is to run the [Get-AllTenantRulesAndForms.ps1](https://github.com/OfficeDev/O365-InvestigationTooling/blob/master/Get-AllTenantRulesAndForms.ps1) PowerShell script. This script connects to every mailbox in your tenant and dumps all the rules and forms into two .csv files. +The simplest way to verify a rules or custom forms attack is to run the [Get-AllTenantRulesAndForms.ps1](https://github.com/OfficeDev/O365-InvestigationTooling/blob/master/Get-AllTenantRulesAndForms.ps1) PowerShell script. This script connects to every mailbox in your organization and dumps all the rules and forms into two .csv files. -#### Pre-requisites +#### Prerequisites -You'll need to have global administrator rights to run the script because the script connects to every mailbox in the tenancy to read the rules and forms. +You need to be a member of the Global Administrator role in [Azure Active Directory](../../admin/add-users/about-admin-roles.md) or the Organization Management role group in [Exchange Online](/exchange/permissions-exo/permissions-exo), because the script connects to every mailbox in the organization to read rules and forms. -1. Sign in to the machine that you'll run the script from with local administrator rights. +1. Use an account with local administrator rights to sign in to the computer where you intend to run the script. -2. Download or copy the Get-AllTenantRulesAndForms.ps1 script from GitHub to a folder from which you'll run it. The script creates two date stamped files to this folder, MailboxFormsExport-yyyy-mm-dd.csv, and MailboxRulesExport-yyyy-mm-dd.csv. +2. Download or copy the contents of the **Get-AllTenantRulesAndForms.ps1** script from GitHub to a folder that's easy to find and run the script from. The script creates two date stamped files in the folder: `MailboxFormsExport-yyyy-mm-dd.csv` and `MailboxRulesExport-yyyy-mm-dd.csv`. -3. Open a PowerShell instance as an administrator and open the folder you saved the script to. + Remove lines 154 to 158 from the script, because that connection method no longer works as of July 2023. -4. Run this PowerShell command line as follows `.\Get-AllTenantRulesAndForms.ps1`.\Get-AllTenantRulesAndForms.ps1 +3. [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). -#### Interpreting the output +4. Navigate in PowerShell to the folder where you saved the script, and then run the following command: -- **MailboxRulesExport-*yyyy-mm-dd*.csv**: Examine the rules (one per row) for action conditions that include applications or executables:+ ```powershell + .\Get-AllTenantRulesAndForms.ps1 + ``` - - **ActionType (column A)**: If you see the value "ID_ACTION_CUSTOM", the rule is likely malicious. -- - **IsPotentiallyMalicious (column D)**: If this value is "TRUE", the rule is likely malicious. -- - **ActionCommand (column G)**: If this column lists an application or any file with .exe or .zip extensions, or an unknown entry that refers to a URL, the rule is likely malicious. +#### Interpreting the output -- **MailboxFormsExport-*yyyy-mm-dd*.csv**: In general, the use of custom forms is rare. If you find any in this workbook, you open that user's mailbox and examine the form itself. If your organization didn't put it there intentionally, it's likely malicious.+- **MailboxRulesExport-*yyyy-mm-dd*.csv**: Examine the rules (one per row) for action conditions that include applications or executables: + - **ActionType (column A)**: The rule is likely malicious if this column contains the value `ID_ACTION_CUSTOM`. + - **IsPotentiallyMalicious (column D)**: The rule is likely malicious if this column contains the value `TRUE`. + - **ActionCommand (column G)**: The rule is likely malicious if this column contains any of the following values: + - An application. + - An .exe or .zip file. + - An unknown entry that refers to a URL. +- **MailboxFormsExport-*yyyy-mm-dd*.csv**: In general, the use of custom forms is rare. If you find any in this workbook, open that user's mailbox and examine the form itself. If your organization didn't put it there intentionally, it's likely malicious. ## How to stop and remediate the Outlook Rules and Forms attack -If you find any evidence of either of these attacks, remediation is simple, just delete the rule or form from the mailbox. You can do this with the Outlook client or using Exchange PowerShell to remove rules. +If you find any evidence of either of these attacks, remediation is simple: just delete the rule or form in the mailbox. You can delete the rule or form using the Outlook client or using Exchange PowerShell. ### Using Outlook -1. Identify all the devices that the user has used with Outlook. They'll all need to be cleaned of potential malware. Don't allow the user to sign on and use email until all the devices are cleaned. +1. Identify all devices where the user has used Outlook. They all need to be cleaned of potential malware. Don't allow the user to sign on and use email until all devices have been cleaned. -2. Follow the steps in [Delete a rule](https://support.microsoft.com/office/2f0e7139-f696-4422-8498-44846db9067f) for each device. +2. On each device, follow the steps in [Delete a rule](https://support.microsoft.com/office/2f0e7139-f696-4422-8498-44846db9067f). 3. If you're unsure about the presence of other malware, you can format and reinstall all the software on the device. For mobile devices, you can follow the manufacturers steps to reset the device to the factory image. -4. Install the most up-to-date versions of Outlook. Remember that the current version of Outlook blocks both types of this attack by default. +4. Install the most up-to-date versions of Outlook. Remember, current version of Outlook blocks both types of this attack by default. -5. Once all offline copies of the mailbox have been removed, reset the user's password (use a high quality one) and follow the steps in [Setup multi-factor authentication for users](../../admin/security-and-compliance/set-up-multi-factor-authentication.md) if MFA hasn't already been enabled. This ensures that the user's credentials aren't exposed via other means (such as phishing or password re-use). +5. Once all offline copies of the mailbox have been removed, do the following steps: + - Reset the user's password using a high quality value (length and complexity). + - If multi-factor authentication (MFA) isn't turned on for the user, follow the steps in [Setup multi-factor authentication for users](../../admin/security-and-compliance/set-up-multi-factor-authentication.md) ++ These steps ensure that the user's credentials aren't exposed via other means (for example, phishing or password reuse). ### Using PowerShell -There are two Exchange PowerShell cmdlets you can use to remove or disable dangerous rules. Just follow the steps. +Connect to the required Exchange PowerShell environment: ++- **Mailboxes on on-premises Exchange servers**: [Connect to Exchange servers using remote PowerShell](/powershell/exchange/connect-to-exchange-servers-using-remote-powershell) or [Open the Exchange Management Shell](/powershell/exchange/open-the-exchange-management-shell). ++- **Mailboxes in Exchange Online**: [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). ++After you connect to the required Exchange PowerShell environment, you can take the following actions on Inbox rules in user mailboxes: ++- **View Inbox rules in a mailbox**: ++ - **View a summary list of all rules** ++ ```powershell + Get-InboxRule -Mailbox laura@contoso.onmicrosoft.com + ``` ++ - **View detailed information for a specific rule**: ++ ```powershell + Get-InboxRule -Mailbox laura@contoso.onmicrosoft.com -Identity "Suspicious Rule Name" | Format-List + ``` ++ For detailed syntax and parameter information, see [Get-InboxRule](/powershell/module/exchange/get-inboxrule). -#### Steps for mailboxes that are on an Exchange server +- **Remove Inbox rules from a mailbox**: -1. Connect to the Exchange server using remote PowerShell or the Exchange Management Shell. Follow the steps in [Connect to Exchange servers using remote PowerShell](/powershell/exchange/connect-to-exchange-servers-using-remote-powershell) or [Open the Exchange Management Shell](/powershell/exchange/open-the-exchange-management-shell). + - **Remove a specific rule**: -2. If you want to completely remove a single rule, multiple rules, or all rules from a mailbox use the [Remove-InboxRule](/powershell/module/exchange/Remove-InboxRule) cmdlet. + ```powershell + Remove-InboxRule -Mailbox laura@contoso.onmicrosoft.com -Identity "Suspicious Rule Name" + ``` -3. If you want to retain the rule and its contents for further investigation use the [Disable-InboxRule](/powershell/module/exchange/disable-inboxrule) cmdlet. + - **Remove all rules**: -#### Steps for mailboxes in Exchange Online + ```powershell + Get-InboxRule -Mailbox laura@contoso.onmicrosoft.com | Remove-InboxRule + ``` -1. Follow the steps in [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). + For detailed syntax and parameter information, see [Remove-InboxRule](/powershell/module/exchange/remove-inboxrule). -2. If you want to completely remove a single rule, multiple rules, or all rules from a mailbox use the [Remove-Inbox Rule](/powershell/module/exchange/Remove-InboxRule) cmdlet. +- **Turn off an Inbox rule for further investigation**: -3. If you want to retain the rule and its contents for further investigation use the [Disable-InboxRule](/powershell/module/exchange/disable-inboxrule) cmdlet. + ```powershell + Disable-InboxRule -Mailbox laura@contoso.onmicrosoft.com -Identity "Suspicious Rule Name" + ``` ++ For detailed syntax and parameter information, see [Disable-InboxRule](/powershell/module/exchange/disable-inboxrule). ## How to minimize future attacks -### First: protect your accounts +### First: protect accounts -The Rules and Forms exploits are only used by an attacker after they've stolen or breached one of your user's accounts. So, your first step to preventing the use of these exploits against your organization is to aggressively protect your user accounts. Some of the most common ways that accounts are breached are through phishing or [password spray attacks](https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/). +The Rules and Forms exploits are only used by an attacker after they've stolen or breached a user's account. So, your first step to preventing the use of these exploits against your organization is to aggressively protect user accounts. Some of the most common ways that accounts are breached are through phishing or [password spray attacks](https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/). -The best way to protect your user accounts, and especially your administrator accounts, is to [set up multi-factor authentication for users](../../admin/security-and-compliance/set-up-multi-factor-authentication.md). You should also: +The best way to protect user accounts (especially admin accounts) is to [set up MFA for users](../../admin/security-and-compliance/set-up-multi-factor-authentication.md). You should also: -- Monitor how your user accounts are [accessed and used](/azure/active-directory/active-directory-view-access-usage-reports). You may not prevent the initial breach, but you'll shorten the duration and the impact of the breach by detecting it sooner. You can use these [Office 365 Cloud App Security policies](/cloud-app-security/what-is-cloud-app-security) to monitor you accounts and alert on unusual activity:+- Monitor how user accounts are [accessed and used](/azure/active-directory/active-directory-view-access-usage-reports). You may not prevent the initial breach, but you can shorten the duration and the effects of the breach by detecting it sooner. You can use these [Office 365 Cloud App Security policies](/cloud-app-security/what-is-cloud-app-security) to monitor accounts and alert you to unusual activity: - - **Multiple failed login attempts**: This policy profiles your environment and triggers alerts when users perform multiple failed login activities in a single session with respect to the learned baseline, which could indicate an attempted breach. + - **Multiple failed login attempts**: Triggers an alert when users perform multiple failed sign in activities in a single session with respect to the learned baseline, which could indicate an attempted breach. - - **Impossible travel**: This policy profiles your environment and triggers alerts when activities are detected from the same user in different locations within a time period that is shorter than the expected travel time between the two locations. This could indicate that a different user is using the same credentials. Detecting this anomalous behavior necessitates an initial learning period of seven days during which it learns a new user's activity pattern. + - **Impossible travel**: Triggers an alert when activities are detected from the same user in different locations within a time period that's shorter than the expected travel time between the two locations. This activity could indicate that a different user is using the same credentials. Detecting this anomalous behavior necessitates an initial learning period of seven days to learn a new user's activity pattern. - - **Unusual impersonated activity (by user)**: This policy profiles your environment and triggers alerts when users perform multiple impersonated activities in a single session with respect to the baseline learned, which could indicate an attempted breach. + - **Unusual impersonated activity (by user)**: Triggers an alert when users perform multiple impersonated activities in a single session with respect to the baseline learned, which could indicate an attempted breach. - Use a tool like [Office 365 Secure Score](/microsoft-365/security/defender/microsoft-secure-score) to manage account security configurations and behaviors. -### Second: Keep your Outlook clients current +### Second: Keep Outlook clients current -Fully updated and patched versions of Outlook 2013, and 2016 disable the "Start Application" rule/form action by default. This ensures that even if an attacker breaches the account, the rule and form actions will be blocked. You can install the latest updates and security patches by following the steps in [Install Office updates](https://support.microsoft.com/office/2ab296f3-7f03-43a2-8e50-46de917611c5). +Fully updated and patched versions of Outlook 2013, and 2016 disable the "Start Application" rule/form action by default. Even if an attacker breaches the account, the rule and form actions are blocked. You can install the latest updates and security patches by following the steps in [Install Office updates](https://support.microsoft.com/office/2ab296f3-7f03-43a2-8e50-46de917611c5). -Here are the patch versions for your Outlook 2013 and 2016 clients: +Here are the patch versions for Outlook 2013 and 2016 clients: - **Outlook 2016**: 16.0.4534.1001 or greater.- - **Outlook 2013**: 15.0.4937.1000 or greater. For more information on the individual security patches, see: - [Outlook 2016 Security Patch](https://support.microsoft.com/help/3191883)- - [Outlook 2013 Security Patch](https://support.microsoft.com/help/3191938) -### Third: Monitor your Outlook clients +### Third: Monitor Outlook clients -Note that even with the patches and updates installed, it's possible for an attacker to change the local machine configuration to re-enable the "Start Application" behavior. You can use [Advanced Group Policy Management](/microsoft-desktop-optimization-pack/agpm/) to monitor and enforce local machine policies on your clients. +Even with the patches and updates installed, it's possible for an attacker to change the local machine configuration to reenable the "Start Application" behavior. You can use [Advanced Group Policy Management](/microsoft-desktop-optimization-pack/agpm/) to monitor and enforce local machine policies on client devices. You can see if "Start Application" has been re-enabled through an override in the registry by using the information in [How to view the system registry by using 64-bit versions of Windows](https://support.microsoft.com/help/305097). Check these subkeys: - **Outlook 2016**: `HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security\`- - **Outlook 2013**: `HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Security\` -Look for the key EnableUnsafeClientMailRules. If it's there and is set to 1, the Outlook security patch has been overridden and the computer is vulnerable to the Form/Rules attack. If the value is 0, the "Start Application" action is disabled. If the updated and patched version of Outlook is installed and this registry key isn't present, then a system isn't vulnerable to these attacks. +Look for the key `EnableUnsafeClientMailRules`: ++- If the value is 1, the Outlook security patch has been overridden and the computer is vulnerable to the Form/Rules attack. +- If the value is 0, the "Start Application" action is disabled. +- If the registry key isn't present and the updated and patched version of Outlook is installed, then the system isn't vulnerable to these attacks. Customers with on-premises Exchange installations should consider blocking older versions of Outlook that don't have patches available. Details on this process can be found in the article [Configure Outlook client blocking](/exchange/configure-outlook-client-blocking-exchange-2013-help). ## See also: - [Malicious Outlook Rules](https://silentbreaksecurity.com/malicious-outlook-rules/) by SilentBreak Security Post about Rules Vector provides a detailed review of how the Outlook Rules.- - [MAPI over HTTP and Mailrule Pwnage](https://sensepost.com/blog/2016/mapi-over-http-and-mailrule-pwnage/) on the Sensepost blog about Mailrule Pwnage discusses a tool called Ruler that lets you exploit mailboxes through Outlook rules.- - [Outlook forms and shells](https://sensepost.com/blog/2017/outlook-forms-and-shells/) on the Sensepost blog about Forms Threat Vector.- - [Ruler Codebase](https://github.com/sensepost/ruler)- - [Ruler Indicators of Compromise](https://github.com/sensepost/notruler/blob/master/iocs.md) |
| security | Outbound Spam Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/outbound-spam-policies-configure.md | You can configure outbound spam policies in the Microsoft 365 Defender portal or - **Groups**: - Members of the specified distribution groups or mail-enabled security groups (dynamic distribution groups aren't supported). - The specified Microsoft 365 Groups.- - **Domains**: All senders in the specified [accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) in your organization. + - **Domains**: All senders in the organization with a primary email address in the specified [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains). Click in the appropriate box, start typing a value, and select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, select :::image type="icon" source="../../media/m365-cc-sc-remove-selection-icon.png" border="false"::: next to the value. |
| security | Preset Security Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/preset-security-policies.md | The rest of this article how to configure preset security policies. - **Groups**: - Members of the specified distribution groups or mail-enabled security groups (dynamic distribution groups aren't supported). - The specified Microsoft 365 Groups.- - **Domains**: All recipients in the specified [accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) in your organization. + - **Domains**: All recipients in the organization with a primary email address in the specified [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains). Click in the appropriate box, start typing a value, and select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, select :::image type="icon" source="../../media/m365-cc-sc-remove-selection-icon.png" border="false"::: next to the value. |
| security | Safe Attachments Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/safe-attachments-policies-configure.md | You configure Safe Attachments policies in the Microsoft 365 Defender portal or - **Groups**: - Members of the specified distribution groups or mail-enabled security groups (dynamic distribution groups aren't supported). - The specified Microsoft 365 Groups.- - **Domains**: All recipients in the specified [accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) in your organization. + - **Domains**: All recipients in the organization with a primary email address in the specified [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains). Click in the appropriate box, start typing a value, and select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, select :::image type="icon" source="../../media/m365-cc-sc-remove-selection-icon.png"::: next to the value. |
| security | Safe Links Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/safe-links-policies-configure.md | You configure Safe Links policies in the Microsoft 365 Defender portal or in Exc - **Groups**: - Members of the specified distribution groups (including non-mail-enabled security groups within distribution groups) or mail-enabled security groups (dynamic distribution groups aren't supported). - The specified Microsoft 365 Groups.- - **Domains**: All recipients in the specified [accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) in your organization. + - **Domains**: All recipients in the organization with a primary email address in the specified [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains). Click in the appropriate box, start typing a value, and select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, select :::image type="icon" source="../../media/m365-cc-sc-remove-selection-icon.png"::: next to the value. |
| security | Try Microsoft Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/try-microsoft-defender-for-office-365.md | Remember, when you evaluate or try Defender for Office 365 in audit mode, specia - **Groups**: - Members of the specified distribution groups or mail-enabled security groups (dynamic distribution groups aren't supported). - The specified Microsoft 365 Groups.- - **Domains**: All recipients in the specified [accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) in your organization. + - **Domains**: All recipients in the organization with a primary email address in the specified [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains). Click in the box, start typing a value, and select the value from the results below the box. Repeat this process as many times as necessary. To remove an existing value, select :::image type="icon" source="../../media/m365-cc-sc-remove-selection-icon.png" border="false"::: next to the value in the box. Remember, when you try Defender for Office 365 in **blocking mode**, the Standar - **Groups**: - Members of the specified distribution groups or mail-enabled security groups (dynamic distribution groups aren't supported). - The specified Microsoft 365 Groups.- - **Domains**: All recipients in the specified [accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) in your organization. + - **Domains**: All recipients in the organization with a primary email address in the specified [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains). Click in the box, start typing a value, and select the value from the results below the box. Repeat this process as many times as necessary. To remove an existing value, select :::image type="icon" source="../../media/m365-cc-sc-remove-selection-icon.png" border="false"::: next to the value in the box. |
| solutions | Contoso Remote Onsite Work | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/contoso-remote-onsite-work.md | Title: "Contoso's COVID-19 response and support for hybrid work"-+ f1.keywords: - NOCSH-+ Last updated 11/19/2020 audience: ITPro |
| solutions | Empower People To Work Remotely Manage Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-manage-endpoints.md | Title: "Step 4. Deploy endpoint management for your devices, PCs, and other endpoints" f1.keywords: - NOCSH--++ Last updated 05/01/2020 audience: ITPro |
| solutions | Empower People To Work Remotely Remote Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-remote-access.md | Title: "Step 2. Provide remote access to on-premises apps and services" f1.keywords: - NOCSH--++ Last updated 05/01/2020 audience: ITPro |
| solutions | Empower People To Work Remotely Secure Sign In | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-secure-sign-in.md | Title: "Step 1. Increase sign-in security for hybrid workers with MFA" f1.keywords: - NOCSH--++ Last updated 05/01/2020 audience: ITPro |
| solutions | Empower People To Work Remotely Security Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-security-compliance.md | Title: "Step 3: Deploy security and compliance for hybrid workers" f1.keywords: - NOCSH--++ Last updated 06/10/2020 audience: ITPro |
| solutions | Empower People To Work Remotely Teams Productivity Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-teams-productivity-apps.md | Title: "Step 5. Deploy hybrid worker productivity apps and services" f1.keywords: - NOCSH--++ Last updated 05/01/2020 audience: ITPro |
| solutions | Empower People To Work Remotely Train Monitor Usage | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-train-monitor-usage.md | Title: "Step 6: Train your workers and address usage feedback" f1.keywords: - NOCSH--++ Last updated 05/01/2020 audience: ITPro |
| solutions | Empower People To Work Remotely | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely.md | Title: "Set up your infrastructure for hybrid work with Microsoft 365"- f1.keywords: - NOCSH-++ Last updated 05/01/2020 audience: ITPro |
| syntex | Feature Limited License | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/feature-limited-license.md | + + Title: MICROSOFT SYNTEX FEATURES LIMITED TIME LICENSE ++++ Last updated : 09/06/2023+audience: admin ++++search.appverid: ++ms.localizationpriority: medium ++description: Read the Microsoft Syntex Features Limited Time License for Syntex features available as a preview for all users. +++# MICROSOFT SYNTEX FEATURES LIMITED TIME LICENSE ++These license terms are an agreement between you and Microsoft Corporation (or one of its affiliates). They apply to the Microsoft Syntex Features described below and do not alter your or MicrosoftΓÇÖs rights relating to the Product Terms ([Microsoft Product Terms](https://www.microsoft.com/licensing/terms/)). IF YOU COMPLY WITH THESE LICENSE TERMS, YOU HAVE THE RIGHTS BELOW. **BY USING THE MICROSOFT SYNTEX FEATURES, INDIVIDUALLY AND COLLECTIVELY YOU ACCEPT THESE TERMS.** ++**MICROSOFT OFFERING - MICROSOFT SYNTEX FEATURES** ++This License governs the limited time use of the following features, individually and collectively, and is referred to as ΓÇ£FeaturesΓÇ¥: ++  i.  Content Query<br> +  ii.  Universal Annotation<br> +  iii.  Contracts Accelerator<br> +  iv.  Accounts Payable Accelerator<br> +  v.  Taxonomy features including: import using SKOS, SKOS formatting reference,<br>     push content type to hub, and term store reports<br> +  vi.  PDF Merge/Split<br> +  vii.  PDF Password Protect<br> +  viii.  Content Processing: Move or copy a file, set a content type from file name ++**REQUIREMENTS TO ENABLE THE FEATURES** ++  a) Customer must have a healthy Azure subscription connected to Microsoft Syntex<br> +  b) A Microsoft 365 tenancy with either Microsoft 365 admin access or SharePoint Online admin access ++**EVALUATION PERIOD** ++This Limited Time License is effective on your acceptance and terminates on the earlier of (i) 30 days following first general availability of a commercial release of the Features in a Microsoft product or a future Microsoft product or (ii) June 30, 2024. ++After the Evaluation Period, Microsoft reserves the right to require an additional SKU for these capabilities. You will not be billed for use during the Evaluation Period. ++**LICENSE** ++The Features are licensed, not sold. Microsoft reserves all other rights. Unless applicable law gives you more rights despite this limitation, you will not (and have no right to): ++**APPLICABLE LAW AND PLACE TO RESOLVE DISPUTES.** ++If you acquired the software in the United States or Canada, the laws of the state or province where you live (or, if a business, where your principal place of business is located) govern the interpretation of this agreement, claims for its breach, and all other claims (including consumer protection, unfair competition, and tort claims), regardless of conflict of laws principles. If you acquired the software in any other country, its laws apply. If U.S. federal jurisdiction exists, you and Microsoft consent to exclusive jurisdiction and venue in the federal court in King County, Washington for all disputes heard in court. If not, you and Microsoft consent to exclusive jurisdiction and venue in the Superior Court of King County, Washington for all disputes heard in court. ++**LIMITATION ON AND EXCLUSION OF REMEDIES AND DAMAGES.** ++**Except as described herein, the only remedy for claims relating to these Terms is for you to terminate your use of the Features. Neither Party can recover any damages, including direct, consequential, lost profits, special, punitive, indirect or incidental damages from the other. This limitation applies:** ++ **1. To claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law.**<br> + **2. Even if one of us knew or should have known about the possibility of the damages.** ++ **The limitations in this section does not apply to claims arising from or in connection with any infringement, misuse, or misappropriation by one of us of the otherΓÇÖs intellectual property rights.** |