Merge branch 'main' of https://github.com/MicrosoftDocs/defender-docs-pr into yelevin/multi-tenant-case-mgmt

yelevin · yelevin · commit 05cc21093123 · 2025-05-12T21:30:02.000+03:00
diff --git a/ATPDocs/deploy/remote-calls-sam.md b/ATPDocs/deploy/remote-calls-sam.md
@@ -7,6 +7,10 @@ ms.topic: how-to
 
 # Configure SAM-R to enable lateral movement path detection in Microsoft Defender for Identity
 
+> [!IMPORTANT]
+> Remote collection of local administrators' group members on endpoints (using SAM-R queries) feature in Microsoft Defender for Identity will be disabled by mid-May 2025.
+> 
+
 Microsoft Defender for Identity mapping for [potential lateral movement paths](/defender-for-identity/understand-lateral-movement-paths) relies on queries that identify local admins on specific machines. These queries are performed with the SAM-R protocol, using the Defender for Identity [Directory Service account](directory-service-accounts.md) you configured.
 
 > [!NOTE]
diff --git a/ATPDocs/whats-new.md b/ATPDocs/whats-new.md
@@ -22,6 +22,15 @@ For more information, see also:
 
 For updates about versions and features released six months ago or earlier, see the [What's new archive for Microsoft Defender for Identity](whats-new-archive.md).
 
+## May 2025
+
+### Local administrators collection (using SAM-R queries) feature will be disabled
+Remote collection of local administrators' group members on endpoints (using SAM-R queries) feature in Microsoft Defender for Identity will be disabled by mid-May 2025. The details collected are used to build the potential lateral movement paths map. Alternative methods are currently being explored.
+
+### New Health Issue
+
+New [health issue](health-alerts.md#network-configuration-mismatch-for-sensors-running-on-vmware) for cases where sensors running on VMware have network configuration mismatch.
+
 ## April 2025
 
 ### Privileged Identity Tag Now Visible in Defender for Identity Inventory
@@ -47,7 +56,6 @@ For more information, see: [Integrations Defender for Identity and PAM services.
 
 ### New Service Account Discovery page
 
-
 Microsoft Defender for Identity now includes a Service Account Discovery capability, offering you  centralized visibility into service accounts across your Active Directory environment.
 
 This update provides:
@@ -60,11 +68,6 @@ This update provides:
 
 For more information, see: [Investigate and protect Service Accounts | Microsoft Defender for Identity](service-account-discovery.md).
 
-
-### New Health Issue
-
-New [health issue](health-alerts.md#network-configuration-mismatch-for-sensors-running-on-vmware) for cases where sensors running on VMware have network configuration mismatch.
-
 ### Enhanced Identity Inventory
 
 The Identities page under *Assets* has been updated to provide better visibility and management of identities across your environment.  
diff --git a/CloudAppSecurityDocs/anomaly-detection-policy.md b/CloudAppSecurityDocs/anomaly-detection-policy.md
@@ -64,14 +64,14 @@ Use this detection to control file uploads and downloads in real time with sessi
 
 By enabling file sandboxing, files that according to their metadata and based on proprietary heuristics to be potentially risky, will also be sandbox scanned in a safe environment. The Sandbox scan may detect files that were not detected based on threat intelligence sources.
 
-Defender for Cloud Apps supports malware detection for the following apps:
+Defender for Cloud Apps supports "File Sandboxing" malware detection for the following apps:
 
 * Box
 * Dropbox
 * Google Workspace
 
 > [!NOTE]
->* Proactively sandboxing will be done in third party applications (*Box*, *Dropbox* etc.). In *OneDrive* and *SharePoint* files are being scanned and sandboxed as part of the service itself.
+>* Proactively sandboxing will be done in third party applications (*Box*, *Dropbox* etc.). **In *OneDrive* and *SharePoint* files are being scanned and sandboxed as part of the service itself**.
 > * In *Box*, *Dropbox*, and *Google Workspace*, Defender for Cloud Apps doesn't automatically block the file, but blocking may be performed according to the app's capabilities and the app's configuration set by the customer.
 > * If you're unsure about whether a detected file is truly malware or a false positive, go to the Microsoft Security Intelligence page at [https://www.microsoft.com/wdsi/filesubmission](https://www.microsoft.com/wdsi/filesubmission) and submit the file for further analysis.
 
diff --git a/CloudAppSecurityDocs/cloud-discovery-policies.md b/CloudAppSecurityDocs/cloud-discovery-policies.md
@@ -44,8 +44,8 @@ Discovery policies enable you to set alerts that notify you when new apps are de
 
 > [!NOTE]
 >
-> - Newly created discovery policies (or policies with updated continuous reports) trigger an alert once in 90 days per app per continuous report, regardless of whether there are existing alerts for the same app. So, for example, if you create a policy for discovering new popular apps, it may trigger additional alerts for apps that have already been discovered and alerted on.
-> - Data from **snapshot reports** do not trigger alerts in app discovery policies.
+> - Newly created discovery policies (or policies with updated continuous reports) trigger an alert once in 90 days per app per continuous report, regardless of whether there are existing alerts for the same app. So, for example, if you create a policy for discovering new popular apps, it might trigger additional alerts for apps that have already been discovered and alerted on.
+> - Data from **snapshot reports** don't trigger alerts in app discovery policies.
 
 For example, if you're interested in discovering risky hosting apps found in your cloud environment, set your policy as follows:
 
@@ -73,6 +73,11 @@ Defender for Cloud Apps searches all the logs in your cloud discovery for anomal
 
 1. Under **Apply to** choose whether this policy applies **All continuous reports** or **Specific continuous reports**. Select whether the policy applies to **Users**, **IP addresses**, or both.
 
+    :::image type="content" source="media/apply-to-continous-reports.png" alt-text="Screenshot showing how to apply file polcies to specific continous reports" lightbox="media/apply-to-continous-reports.png":::
+
+    > [!IMPORTANT]
+    > When you configure an app discovery policy and select **Apply to > All continuous reports**, multiple alerts are generated for each discovery stream, including the global stream which aggregates data from all sources. To control alert volume, select **Apply to > Specific continuous reports** and choose only the relevant streams for your policy.
+    > Learn more: [Defender for Cloud apps continuous risk assessment reports](set-up-cloud-discovery.md#snapshot-and-continuous-risk-assessment-reports)
 1. Select the dates during which the anomalous activity occurred to trigger the alert under **Raise alerts only for suspicious activities occurring after date.**
 
 1. Set a **Daily alert limit** under **Alerts**. Select if the alert is sent as an email. Then provide email addresses as needed.
diff --git a/CloudAppSecurityDocs/media/apply-to-continous-reports.png b/CloudAppSecurityDocs/media/apply-to-continous-reports.png
diff --git a/defender-endpoint/TOC.yml b/defender-endpoint/TOC.yml
@@ -326,6 +326,7 @@
               - name: User experiences in Defender for Endpoint on Android
                 href: android-new-ux.md
               - name: User experiences in Defender for Endpoint on iOS
+                href: ios-new-ux.md
               - name: Mobile device resources for Defender for Endpoint 
                 href: mobile-resources-defender-endpoint.md
               - name: Configure Defender for Endpoint on Android features
diff --git a/defender-endpoint/data-storage-privacy.md b/defender-endpoint/data-storage-privacy.md
@@ -3,8 +3,8 @@ title: Microsoft Defender for Endpoint data storage and privacy
 description: Learn about how Microsoft Defender for Endpoint handles privacy and data that it collects.
 keywords: Microsoft Defender for Endpoint, data storage and privacy, storage, privacy, licensing, geolocation, data retention, data
 ms.service: defender-endpoint
-ms.author: deniseb
-author: denisebmsft
+ms.author: ewalsh
+author: emmwalshh
 ms.localizationpriority: medium
 manager: deniseb
 audience: ITPro
@@ -16,7 +16,7 @@ ms.collection:
 - essentials-compliance
 ms.topic: conceptual
 search.appverid: met150
-ms.date: 08/20/2024
+ms.date: 05/12/2025
 ---
 
 # Microsoft Defender for Endpoint data storage and privacy
@@ -27,7 +27,6 @@ ms.date: 08/20/2024
 
 - [Microsoft Defender for Endpoint Plan 1](microsoft-defender-endpoint.md)
 - [Microsoft Defender for Endpoint Plan 2](microsoft-defender-endpoint.md)
-- [Microsoft Defender XDR](/defender-xdr)
 - [Microsoft Defender for Business](/defender-business/mdb-overview)
 
 > Want to experience Defender for Endpoint? [Sign up for a free trial.](https://go.microsoft.com/fwlink/p/?linkid=2225630)
diff --git a/defender-vulnerability-management/tvm-security-baselines.md b/defender-vulnerability-management/tvm-security-baselines.md
@@ -12,7 +12,7 @@ ms.collection:
 - Tier1
 ms.topic: conceptual
 search.appverid: met150
-ms.date: 04/24/2025
+ms.date: 05/12/2025
 ---
 
 # Security baselines assessment
@@ -33,14 +33,14 @@ A security baseline profile is a customized profile that you can create to asses
 Security baselines provide support for Center for Internet Security (**CIS)** benchmarks for Windows 10, Windows 11, and Windows Server 2008 R2 and above, as well as Security Technical Implementation Guides (**STIG)** benchmarks for Windows 10 and Windows Server 2019.
 
 > [!NOTE]
-> The benchmarks currently only support Group Policy Object (GPO) configurations and not Microsoft Configuration Manager (Intune).
+> - The benchmarks currently only support Group Policy Object (GPO) configurations and not Microsoft Configuration Manager (Intune).</br>
+> - Security baseline assessment is not supported on non-English Windows system locale.</br>
+> - Security baseline assessment is not supported when DFSS (Dynamic Fair Share Scheduling) is enabled on Windows Server 2012 R2.</br>
+> - For security baseline assessment to be successful, **PowerShell Constrained Language Mode** must be set to **off** on your devices.
 
 > [!TIP]
 > Did you know you can try all the features in Microsoft Defender Vulnerability Management for free? Find out how to [sign up for a free trial](defender-vulnerability-management-trial.md).
 
-> [!NOTE]
-> Security baseline assessment is not supported when DFSS (Dynamic Fair Share Scheduling) is enabled on Windows Server 2012 R2.
-
 ## Get started with security baselines assessment
 
 1. Go to **Vulnerability management** > **Baselines assessment** in the [Microsoft Defender portal](https://security.microsoft.com).
@@ -74,9 +74,6 @@ Useful icons to be aware of:
 
 ![Not using the default value](/defender/media/defender-vulnerability-management/customized_value.png) - This configuration has been customized and is not using the default value.
 
-> [!NOTE]
-> For security baseline assessment to be successful, **PowerShell Constrained Language Mode** must be set to **off** on your devices.
-
 ## Security baselines assessment overview
 
 On the security baselines assessment overview page you can view device compliance, profile compliance, top failing devices and top misconfigured devices.
diff --git a/defender-xdr/alert-policies.md b/defender-xdr/alert-policies.md
@@ -344,4 +344,12 @@ Here are some tasks you can perform to manage alerts.
   - The name (and link) of the corresponding alert policy.
   - The incident where the alert is aggregated.
 
-- [**Tune an alert**](investigate-alerts.md#tune-an-alert): You can set properties, conditions, and actions to hide or resolve an alert.
+- **[Tune an alert](investigate-alerts.md#tune-an-alert)**: You can set properties, conditions, and actions to hide or resolve an alert.
+- **Change the severity level for an alert policy**
+
+   1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com/) using credentials for an administrator account in your Microsoft 365 organization.
+   2. Navigate to **Email & Collaboration > Policies & rules** page, then select **Alerts policy**.
+   3. Select the policy you want to update from the list. In the **Actions** column, select the three dots then select **Edit**.
+   4. In the **Edit Policy** pane, select the dropdown menu to adjust the **Severity** level. If applicable, you can also modify the **Trigger settings** for the policy.
+   5. Select **Next** to proceed to rest of the steps.
+   6. Select **Submit** to apply the new changes to the policy, then select **Done** to finish editing.
diff --git a/defender-xdr/automatic-attack-disruption-exclusions.md b/defender-xdr/automatic-attack-disruption-exclusions.md
@@ -18,7 +18,7 @@ ms.topic: conceptual
 search.appverid: 
   - MOE150
   - MET150
-ms.date: 02/16/2025
+ms.date: 05/12/2025
 appliesto:
 - Microsoft Defender XDR
 ---
@@ -116,8 +116,14 @@ To remove an exclusion:
 
 - Device group exclusions can be configured in the **Device groups** tab. Select the device group you want to configure from the list and choose the appropriate exclusion from the flyout pane. Select **Save** to save the exclusion.
 
+## Opt out of automatic attack disruption
+
+If you must opt out of attack disruption, you can do so by opening a support case in the Microsoft Defender portal with the subject *Attack disruption opt-out*. In your request, please specify that you wish to opt out of attack disruption and include a brief explanation about your decision. This feedback helps us improve the feature and better understand customer needs. By opting out, you'll still receive alerts related to attack disruption but no automated actions are taken.
+
+Opting out of attack disruption can greatly increase security risk. Consider [excluding specific entities](automatic-attack-disruption-exclusions.md#review-or-change-automated-response-exclusions-for-assets) instead. 
+
 ## See also
 
 - [View details and results of automated attack disruption actions](autoad-results.md)
 
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]
+[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]
diff --git a/unified-secops-platform/mto-advanced-hunting.md b/unified-secops-platform/mto-advanced-hunting.md
@@ -32,6 +32,8 @@ Multiple workspaces per tenant are supported in multitenant Advanced hunting as
 
 Advanced hunting in multitenant organizations returns up to 50,000 records in total. For more information about service limits in advanced hunting, read [Understand advanced hunting quotas](/defender-xdr/advanced-hunting-limits#understand-advanced-hunting-quotas-and-usage-parameters).
 
+
+
 ## Run cross-tenant queries
 
 You can run any query that you already have access to in the multitenant management **Advanced hunting** page.
@@ -72,8 +74,6 @@ You can run any query that you already have access to in the multitenant managem
 To learn more about advanced hunting in Microsoft Defender XDR, read [Proactively hunt for threats with advanced hunting in Microsoft Defender XDR](/defender-xdr/advanced-hunting-overview).
 
 
-
-
 ## Run cross-workspace queries (Preview)
 
 To run queries across multiple workspaces in the same tenant, use the [workspace( ) expression](/azure/azure-monitor/logs/cross-workspace-query#query-across-log-analytics-workspaces-using-workspace), with the workspace identifier as the argument in your query to refer to a table in a different workspace.
@@ -98,8 +98,17 @@ For more information, see [Query multiple workspaces](/azure/sentinel/extend-sen
 > [!NOTE]
 > If you have tables with the same name but different schemas in multiple workspaces and want to use them in the same query, you should use the workspace operator to uniquely identify the table that you need.
 
+## View schema tables
+
+You can view the [advanced hunting schema tables](/defender-xdr/advanced-hunting-schema-tables) in the left pane inside the advanced hunting page under the **Schema** tab. 
+
+The schema list is a unified view of all tables from all your tenants regardless of the tenant selected in the upper right tenant selector.
+
+This could mean that some tables that appear here might only be available for query in some tenants, like custom Microsoft Sentinel tables.
+
+
+## View and manage custom detection rules
 
-## Custom detection rules
 
 You can also manage custom detection rules from multiple tenants in the custom detection rules page.
 
