Merge branch 'main' into docs-editor/fixed-reported-inaccuracies-1744100267

Author: denisebmsft

CloudAppSecurityDocs/activity-filters-queries.md

@@ -135,7 +135,7 @@ Defender for Cloud Apps also provides you with **Suggested queries**. Suggested
 - Successful log in - Filters all your activities to display only those activities that involve successful sign-ins, including impersonate action, impersonate sign-in, single sign-o sign-ins, and sign-in from a new device.
 
   ![query activities.](media/queries-activity.png)
-
+  
 Additionally, you can use the suggested queries as a starting point for a new query. First, select one of the suggested queries. Then, make changes as needed and finally select **Save as** to create a new **Saved query**.
 
 ### Query activities six months back
@@ -184,37 +184,6 @@ Reports that include private activities are marked with an Eye icon in the repor
 
 ![eye-icon](media/activity-filters-queries/eye-icon-to-indicate-private-report.png)
 
-> [!NOTE] 
->Exporting and viewing activity data up to six months back is restricted to specific roles with elevated permissions.
-
-The following roles are supported:
-
-- `INVITED_ADMIN`
-
-- `GLOBAL_ADMINISTRATOR`
-
-- `SECURITY_ADMINISTRATOR`
-
-- `MCAS_ADMINISTRATOR`
-
-- `DISCOVERY_ADMIN`
-
-- `SECURITY_OPERATOR`
-
-- `COMPLIANCE_ADMIN`
-
-- `SECURITY_READER`
-
-- `GLOBAL_READER`
-
-- `URBAC_ROLES_GLOBAL_ADMINISTRATOR`
-
-- `URBAC_ROLES_COMPLIANCE_ADMINISTRATOR`
-
-- `URBAC_ROLES_SECURITY_READER`
-
-- `URBAC_ROLES_SECURITY_OPERATOR`
-
 ## Next steps
 
 > [!div class="nextstepaction"]

CloudAppSecurityDocs/attack-paths.md

@@ -10,9 +10,6 @@ ms.date: 03/23/2025
 [Microsoft Security Exposure Management](/security-exposure-management/microsoft-security-exposure-management) helps you to manage your company's attack surface and exposure risk effectively. By combining assets and techniques, [attack paths](/security-exposure-management/review-attack-paths) illustrate the end-to-end paths that attackers can use to move from an entry point within your organization to your critical assets.
 Microsoft Defender for Cloud Apps observed an increase in attackers using OAuth applications to access sensitive data in business-critical applications like Microsoft Teams, SharePoint, Outlook, and more. To support investigation and mitigation, these applications are integrated into the attack path and attack surface map views in Microsoft Security Exposure Management.
 
-### Critical Asset Management - Service Principals
-
-Microsoft Defender for Cloud Apps defines a set of critical privilege OAuth permissions. OAuth applications with these permissions are considered high-value assets. If compromised, an attacker can gain high privileges to SaaS applications. To reflect this risk, attack paths treat service principals with these permissions as target goals.
 
 ### Prerequisites
 
@@ -44,21 +41,26 @@ Alternatively, you can use one of the following **Entra ID roles**:
 >[!NOTE]
 > Currently available in commercial cloud environments only. Microsoft Security Exposure Management data and capabilities are currently unavailable in U.S Government clouds - GCC, GCC High, DoD, and China Gov.
 
-## View permissions for critical assets
+### Critical Asset Management - Service Principals
+
+Microsoft Defender for Cloud Apps defines a set of critical privilege OAuth permissions. OAuth applications with these permissions are considered high-value assets. If compromised, an attacker can gain high privileges to SaaS applications. To reflect this risk, attack paths treat service principals with these permissions as target goals.
+
+#### View permissions for critical assets
 
 To view the full list of permissions, go to the  [Microsoft Defender portal](https://security.microsoft.com) and navigate to Settings > Microsoft Defender XDR > Rules > Critical asset management.
 
 :::image type="content" source="media/saas-securty-initiative/screenshot-of-the-critical-asset-management-page.png" alt-text="Screenshot of the Critical asset management page in the Defender XDR portal." lightbox="media/saas-securty-initiative/Screenshot-of-the-critical-asset-management-page.png":::
 
-> [!NOTE]  
-> OAuth apps appear in the attack path surface map only when specific conditions are detected.  
-> For example, an OAuth app may appear in the attack path only if a vulnerable component with an easily exploitable entry point is detected that allows lateral movement to service principals with high privileges.
 
 ## Investigation user flow: View attack paths involving OAuth applications
 
 Once you understand which permissions represent high-value targets, use the following steps to investigate how these applications appear in your environment’s attack paths.
 For smaller organizations with a manageable number of attack paths, we recommend following this structured approach to investigate each attack path:
 
+> [!NOTE]  
+> OAuth apps show in the attack path surface map only when specific conditions are detected.  
+> For example, an OAuth app might appear in the attack path if a vulnerable component with an easily exploitable entry point is detected. This entry point allows lateral movement to service principals with high privileges.
+
 1. Go to Exposure Management > Attack surface > Attack paths.
 
 1. Filter by 'Target type: AAD Service principal'

CloudAppSecurityDocs/caac-known-issues.md

@@ -51,6 +51,9 @@ For example, assume that a session policy is configured to prevent downloading f
 
 Session policies don't protect external business-to-business (B2B) collaboration users in Microsoft Teams applications.
 
+## Session Controls with Non-Interactive Tokens
+Some applications utilize non-interactive access tokens to facilitate seamless redirection between apps within the same suite or realm. When one application is onboarded to Conditional Access App Control and the other is not, session controls may not be enforced as expected. For example, if the Teams client retrieves a non-interactive token for SharePoint Online (SPO), it can initiate an active session in SPO without prompting the user for reauthentication. As a result, the session control mechanism cannot intercept or enforce policies on these sessions. To ensure consistent enforcement, it's recommended to onboard all relevant applications, such as Teams, alongside SPO. 
+
 ## Limitations for sessions that the reverse proxy serves
 
 The following limitations apply only on sessions that the reverse proxy serves. Users of Microsoft Edge can benefit from in-browser protection instead of using the reverse proxy, so these limitations don't affect them.

defender-endpoint/configure-endpoints-gp.md

@@ -1,5 +1,5 @@
 ---
-title: Onboard Windows devices to Microsoft Defender for Endpoint via Group Policy
+title: Onboard Windows Servers to Microsoft Defender for Endpoint via Group Policy
 description: Use Group Policy to deploy the configuration package on Windows devices so that they are onboarded to the service.
 ms.service: defender-endpoint
 ms.author: deniseb

defender-endpoint/configure-endpoints-script.md

@@ -1,5 +1,5 @@
 ---
-title: Onboard Windows devices using a local script
+title: Onboard Windows Servers using a local script
 description: Use a local script to deploy the configuration package on devices to enable onboarding of the devices to the service.
 search.appverid: met150
 ms.service: defender-endpoint

defender-endpoint/device-health-microsoft-defender-antivirus-health.md

@@ -6,7 +6,7 @@ ms.service: defender-endpoint
 ms.author: ewalsh
 author: emmwalshh
 ms.localizationpriority: medium
-ms.date: 03/13/2025
+ms.date: 04/08/2025
 manager: deniseb
 audience: ITPro
 ms.collection:
@@ -36,7 +36,7 @@ The Device Health report provides information about the devices in your organiza
 >
 > - Device is onboarded to Microsoft Defender for Endpoint
 > - OS: Windows 10, Windows 11, Windows Server 2012 R2/, 2016 R2/ 2019/2022 (non MMA), MacOS, Linux 
-> - Sense (MsSense.exe): **10.8210.** \*+. See [Prerequisites](#prerequisites) section for related details.
+> - Sense (MsSense.exe): **10.8210.** \*+.
 >
 > For Windows Server 2012 R2 and Windows Server 2016 to appear in device health reports, these devices must be onboarded using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016](onboard-windows-server-2012r2-2016.md#functionality-in-the-modern-unified-solution).
 
@@ -48,7 +48,6 @@ In the Microsoft Defender portal, in the navigation pane, select **Reports**, an
   - [View device health cards](#view-device-health-cards)
   - [Report access permissions](#report-access-permissions)
   - [Microsoft Defender Antivirus health tab](#microsoft-defender-antivirus-health-tab)
-    - [Prerequisites](#prerequisites)
     - [Card functionality](#card-functionality)
       - [New Microsoft Defender Antivirus filter definitions](#new-microsoft-defender-antivirus-filter-definitions)
       - [Export report](#export-report)
@@ -119,20 +118,6 @@ For the three `updates` cards (also known as up-to-date reporting cards), "**No
 - Cloud protection isn't enabled.
 - Device doesn't meet pre-requisites for Antivirus engine or platform version.
 
-### Prerequisites
-
-Up-to-date reporting generates information for devices that meet the following criteria:
-
-* **Windows:**
-  * OS - Windows 10 1809 or later  
-  * Engine version: 1.1.19300.2+  
-  * Platform version: 4.8.2202.1+  
-  * Sense (MsSense.exe): 10.8210.*+  
-
-* **Linux and Mac:**
-  * Platform version: 101.23112.*+  
-
-* **Cloud Protection enabled**
 
 :::image type="content" source="media/device-health-defender-antivirus-health-tab.png" alt-text="Shows the Microsoft Defender Antivirus Health tab." lightbox="media/device-health-defender-antivirus-health-tab.png":::
 
@@ -174,7 +159,7 @@ There are two different export csv functionalities through the portal:
 
 - **Top level export**. You can use the top-level **Export** button to gather an all-up Microsoft Defender Antivirus health report (500-K limit).
 
-:::image type="content" source="media/device-health-defender-antivirus-health-tab-export.png" alt-text="Screenshot that shows the top-level export report button." lightbox="media/device-health-defender-antivirus-health-tab-export.png":::
+  :::image type="content" source="media/device-health-defender-antivirus-health-tab-export.png" alt-text="Screenshot that shows the top-level export report button." lightbox="media/device-health-defender-antivirus-health-tab-export.png":::
 
 - **Flyout level export**. You can use the **Export** button within the flyouts to export a report to an Excel spreadsheet (100-K limit).
 
@@ -288,14 +273,15 @@ For more information about the aforementioned terms, refer back to the section:
 
 > [!NOTE]
 >
-> Up to date reporting generates information for devices that meet the following criteria:
->
-> - Engine version: `1.1.19300.2` or later
-> - Platform version: `4.18.2202.1` or later
-> - Cloud protection enabled
-> - Windows OS
->
-> Currently up to date reporting is only available for Windows devices. Cross platform devices such as Mac and Linux are listed under `no data available`.>
+> Up-to-date reporting generates information for devices that meet the following criteria:
+> * **Windows:**
+>    * OS - Windows 10 1809 or later
+>    * Engine version: 1.1.19300.2+  
+>    * Platform version: 4.8.2202.1+  
+>    * Sense (MsSense.exe): 10.8210.*+  
+> * **Linux and Mac:**
+>    * Platform version: 101.23112.*+  
+> * **Cloud Protection enabled**
 
 ##### Up-to-date definitions