Merge branch 'main' into docs-editor/schedule-antivirus-scans-group-1742258128

Author: Ruchika-mittal01

ATPDocs/whats-new.md

@@ -24,6 +24,17 @@ For updates about versions and features released six months ago or earlier, see
 
 ## March 2025
 
+### Enhanced Identity Inventory (Preview)
+
+The Identities page under *Assets* has been updated to provide better visibility and management of identities across your environment.  
+The updated Identities Inventory page now includes the following tabs:
+
+- Identities: A consolidated view of identities across Active Directory, Entra ID. This Identities tab highlights key details, including identity types, and user's information. 
+
+- Cloud application accounts: Displays a list of cloud application accounts, including those from application connectors and third-party sources (original available in the previous version based on Microsoft Defender for Cloud Apps). 
+
+For more information, see [Identity inventory details](/defender-for-identity/identity-inventory). 
+
 ### New LDAP query events added to the IdentityQueryEvents table in Advanced Hunting
 New LDAP query events were added to the `IdentityQueryEvents` table in Advanced Hunting to provide more visibility into additional LDAP search queries running in the customer environment.
 

CloudAppSecurityDocs/release-notes.md

@@ -21,6 +21,16 @@ For news about earlier releases, see [Archive of past updates for Microsoft Defe
 
 ## March 2025
 
+### Enhanced Identity Inventory (Preview)
+
+The Identities page under *Assets* has been updated to provide better visibility and management of identities across your environment. The updated Identities Inventory page now includes the following tabs:
+
+- Identities: A consolidated view of identities across Active Directory, Entra ID. This Identities tab highlights key details, including identity types, and user's information.
+
+- Cloud application accounts: Provides insights into accounts from connected applications via Defender for Cloud Apps, allowing investigation of account permissions, group memberships, aliases, and the applications in use.
+
+For more information, see [Identity inventory details](/defender-for-identity/identity-inventory), [Cloud application accounts](/defender-cloud-apps/accounts).
+
 ### Role-Based Access Control scoping for "Behaviors" (Preview)
 
 Defender for Cloud Apps customers can now configure Role-Based Access Control (RBAC) scoping for 'Behaviors.' This new capability allows administrators to define and manage access permissions more precisely. Administrators can ensure that users have the appropriate level of access to specific application data based on their roles and responsibilities. By using RBAC scoping, organizations can enhance their security posture, streamline operations, and reduce the risk of unauthorized access.

defender-endpoint/application-deployment-via-mecm.md

@@ -13,104 +13,120 @@ ms.collection:
 - m365-security
 - tier1
 ms.topic: conceptual
-ms.date: 06/27/2022
+ms.date: 03/14/2025
 ---
 
 # Migrating servers from Microsoft Monitoring Agent to the unified solution
 
 **Applies to:**
 
-- Windows Server 2012 R2
-- Windows Server 2016
+- Microsoft Defender for Endpoint for servers
+- Microsoft Defender for Servers Plan 1 or Plan 2
 
-This article guides you in migrating down-level servers from Microsoft Monitoring Agent (MMA) to the unified solution.
+This article guides you in migrating servers running Windows Server 2016 or Windows Server 2012 R2 from Microsoft Monitoring Agent (MMA) to the modern, unified solution. In this article, the phrase *down-level servers* refers to older versions of Windows Server, such as Windows Server 2016 and Windows Server 2012 R2.
 
 ## Prerequisites
 
-- Microsoft Endpoint Configuration Manager (MECM) higher than 2207.
+- Microsoft Configuration Manager higher than 2207.
 - Down-level OS devices in your environment onboarded with Microsoft Monitoring Agent. To confirm, verify that `MsSenseS.exe` is running in Task Manager.
 - Presence of the MMA agent. You can verify it by checking if the correct Workspace ID is present in the Control Panel> Microsoft Monitoring Agent.
 - Active Microsoft Defender portal with devices onboarded.
-- A **Device Collection** containing down-level servers such as Windows Server 2012 R2 or Windows Server 2016 using MMA agent is set up in your MECM instance.
+- A **Device Collection** containing down-level servers such as Windows Server 2012 R2 or Windows Server 2016 using MMA agent is set up in your Configuration Manager instance.
 
-For more information on installing the listed prerequisites, see [related topics](#related-topics) section.
+For more information on installing the listed prerequisites, see [related articles](#related-articles) section.
 
 ## Gather required files
 
-Copy the unified solution package, onboarding script and migration script to the same content source you deploy other apps with MECM.
+Copy the unified solution package, onboarding script, and migration script to the same content source you deploy other apps with Configuration Manager.
+
+1. Download Onboarding Script and the unified solution from [Microsoft Defender portal settings page](https://sip.security.microsoft.com/preferences2/onboarding).
 
-1. Download Onboarding Script and the unified solution from [Microsoft Defender XDR settings page](https://sip.security.microsoft.com/preferences2/onboarding).
    :::image type="content" source="media/onboarding-script.png" alt-text="Screenshot of onboarding script and unified solution download" lightbox="media/onboarding-script.png":::
+
    > [!Note]
    > You must select the Group Policy from the Deployment method dropdown to obtain the .cmd file.
+
 2. Download the migration script from the document: [Server migration scenarios from the previous, MMA-based Microsoft Defender for Endpoint solution](server-migration.md). This script can also be found on GitHub: [GitHub - microsoft/mdefordownlevelserver](https://github.com/microsoft/mdefordownlevelserver).
-3. Save all three files in a shared folder used by MECM as a Software Source.
 
-   :::image type="content" source="media/ua-migration.png" alt-text="Screenshot of saving the shared folder by MECM.":::
+3. Save all three files in a shared folder used by Configuration Manager as a Software Source.
+
+   :::image type="content" source="media/ua-migration.png" alt-text="Screenshot of saving the shared folder by Configuration Manager.":::
 
 ## Create the package as an application
 
-1. In the MECM console, follow these steps: **Software Library>Applications>Create Application**.
+1. In the Configuration Manager console, go to **Software Library** > **Applications** > **Create Application**.
+
 2. Select **Manually specify the application information**.
    :::image type="content" source="media/manual-application-information.png" alt-text="Screenshot of manually specifying the application information selection." lightbox="media/manual-application-information.png":::
+
 3. Select **Next** on the Software Center screen of the wizard.
-4. On the Deployment Types, click **Add**.
+
+4. On the Deployment Types, select **Add**.
+
 5. Select **Manually to specify the deployment type information** and select **Next**.
+
 6. Give a name to your script deployment and select **Next**.
 
    :::image type="content" source="media/manual-deployment-information.png" alt-text="Screenshot specifying the script deployment information.":::
-7. On this step, copy the UNC path that your content is located. Example: `\\ServerName\h$\SOFTWARE_SOURCE\path`.
+
+7. Copy the UNC path that your content is located. Example: `\\ServerName\h$\SOFTWARE_SOURCE\path`.
 
    :::image type="content" source="media/deployment-type-wizard.png" alt-text="Screenshot that shows UNC path copy.":::
 
-8. Additionally, set the following as the installation program:
+8. Set the installation program by using the following command:
 
      ```powershell
       Powershell.exe -ExecutionPolicy ByPass -File install.ps1 -RemoveMMA <workspace ID> -OnboardingScript .\WindowsDefenderATPOnboardingScript.cmd
      ```
 
-      Click **Next** and make sure to add your own Workspace ID in this section.
-9. Click **Next** and click add a clause.
-10. The detection method will be based on the registry key shown below.
-      `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sense`
-
-      Check the option: **This registry setting must exit on the target system to indicate presence of this application.**
+   Select **Next**, and make sure to add your own Workspace ID in this section.
 
-      :::image type="content" source="media/detection-wizard.png" alt-text="Screenshot that shows detection type wizard":::
+9. Select **Next**, and then select **add a clause**.
 
-      > [!TIP]
-      > The registry key value was obtained by running the Powershell command shown below on a device that has the unified solution installed. Other creative methods of detection can also be used. The goal is to identify whether the unified solution has already been installed on a specific device. You can leave the Value and Data Type fields as blank.
+10. The detection method is based on this registry key: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sense`.
 
+     Select the option: **This registry setting must exit on the target system to indicate presence of this application.**
+  
+     :::image type="content" source="media/detection-wizard.png" alt-text="Screenshot that shows detection type wizard":::
+  
+     > [!TIP]
+     > The registry key value was obtained by running the following PowerShell command on a device that has the unified solution installed. Other creative methods of detection can also be used. The goal is to identify whether the unified solution has already been installed on a specific device. You can leave the Value and Data Type fields as blank.
+  
      ```powershell
-      get-wmiobject Win32_Product | Sort-Object -Property Name |Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize
+     get-wmiobject Win32_Product | Sort-Object -Property Name |Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize
      ```
 
-11. In the **User Experience** section, check the recommended settings shown in the screenshot. You can choose what suits your environment and click **Next**. For **Installation program visibility**, it's advisable to install with **Normal** during phase testing then change it to **Minimized** for general deployment.
+11. In the **User Experience** section, check the recommended settings shown in the screenshot. You can choose what suits your environment, and then select **Next**. 
 
+     For **Installation program visibility**, it's advisable to install with **Normal** during phase testing then change it to **Minimized** for general deployment.
+  
      > [!TIP]
      > The maximum allowed runtime can be lowered from (default) 120 minutes to 60 minutes.
+  
+     :::image type="content" source="media/user-experience-in-deployment-type-wizard.png" alt-text="Screenshot that shows user experience in deployment-type wizard." lightbox="media/user-experience-in-deployment-type-wizard.png":::
 
-     :::image type="content" source="media/user-experience-in-deployment-type-wizard.png" alt-text="Screenshot that shows user experience in deployment-type wizard.":::
+12. Add any additional requirements, and then select **Next**.
 
-12. Add any additional requirements then select **Next**.
 13. Under the Dependencies section, select **Next**.
-14. Select **Next** until completion screen comes up, then **Close**.
-15. Keep select **Next** until the completion of Application Wizard. Verify all have been green checked.
+
+14. Select **Next** until completion screen comes up, and then select **Close**.
+
+15. Keep selecting **Next** until the completion of Application Wizard. Verify all have been green checked.
+
 16. Close the wizard, right-click on the recently created application and deploy it to your down-level-server collection. Locally, the installation can be confirmed at Software Center. For details, check the CM logs at `C:\Windows\CCM\Logs\AppEnforce.log`.
 
     :::image type="content" source="media/deploy-application.png" alt-text="Screenshot that shows deployment of created application." lightbox="media/deploy-application.png":::
 
-17. Verify the status of the migration at MECM > Monitoring > Deployments.
+17. Verify the status of the migration in Configuration Manager by going to **Monitoring** > **Deployments**.
 
-    :::image type="content" source="media/deployment-status.png" alt-text="Screenshot that shows deployment status check." lightbox="media/deployment-status.png":::
+18. Troubleshooting .ETL files are created and automatically saved locally in each server at this location `C:\Windows\ccmcache\#\`. These files can be leveraged by support to troubleshoot onboarding issues.
 
-18. Troubleshooting .ETL files will be created and automatically saved locally in each server at this location `C:\Windows\ccmcache\#\`. These files can be leveraged by support to troubleshoot onboarding issues.
-
-## Related topics
+## Related articles
 
 - [Microsoft Monitoring Agent Setup](/services-hub/health/mma-setup)
 - [Deploy applications - Configuration Manager](/mem/configmgr/apps/deploy-use/deploy-applications)
 - [Microsoft Defender for Endpoint - Configuration Manager](/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection)
 - [Onboard Windows servers to the Microsoft Defender for Endpoint service](configure-server-endpoints.md)
 - [Microsoft Defender for Endpoint: Defending Windows Server 2012 R2 and 2016](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/defending-windows-server-2012-r2-and-2016/ba-p/2783292)
+
 [!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]