Skip to content

Commit 41c45ca

Browse files
authored
Merge branch 'main' into diannegali-crosscloudmto
2 parents ea6c057 + 60b4052 commit 41c45ca

File tree

407 files changed

+5149
-5127
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

407 files changed

+5149
-5127
lines changed

.github/workflows/AutoLabelMsftContributor.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,5 @@ jobs:
3131
PayloadJson: ${{ needs.download-payload.outputs.WorkflowPayload }}
3232
secrets:
3333
AccessToken: ${{ secrets.GITHUB_TOKEN }}
34-
TeamReadAccessToken: ${{ secrets.ORG_READTEAMS_TOKEN }}
34+
ClientId: ${{ secrets.M365_APP_CLIENT_ID }}
35+
PrivateKey: ${{ secrets.M365_APP_PRIVATE_KEY }}

.github/workflows/StaleBranch.yml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: (Scheduled) Stale branch removal
2+
3+
permissions:
4+
contents: write
5+
6+
on:
7+
schedule:
8+
- cron: "0 */12 * * *"
9+
10+
workflow_dispatch:
11+
12+
13+
jobs:
14+
15+
stale-branch:
16+
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-StaleBranch.yml@workflows-prod
17+
with:
18+
PayloadJson: ${{ toJSON(github) }}
19+
RepoBranchSkipList: '[
20+
"ExampleBranch1",
21+
"ExampleBranch2"
22+
]'
23+
ReportOnly: true
24+
secrets:
25+
AccessToken: ${{ secrets.GITHUB_TOKEN }}

.openpublishing.redirection.defender-endpoint.json

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
11
{
22
"redirections": [
3+
{
4+
"source_path": "defender-endpoint/threat-analytics-analyst-reports.md",
5+
"redirect_url": "/defender-xdr/threat-analytics-analyst-reports",
6+
"redirect_document_id": false
7+
},
8+
{
9+
"source_path": "defender-endpoint/threat-analytics.md",
10+
"redirect_url": "/defender-xdr/threat-analytics",
11+
"redirect_document_id": false
12+
},
313
{
414
"source_path": "defender-endpoint/configure-microsoft-threat-experts.md",
515
"redirect_url": "/defender-xdr/defender-experts-for-hunting",
@@ -84,6 +94,21 @@
8494
"source_path": "defender-endpoint/monthly-security-summary-report.md",
8595
"redirect_url": "/defender-endpoint/threat-protection-reports#monthly-security-summary",
8696
"redirect_document_id": true
97+
},
98+
{
99+
"source_path": "defender-endpoint/run-analyzer-macos-linux.md",
100+
"redirect_url": "/defender-endpoint/overview-client-analyzer",
101+
"redirect_document_id": true
102+
},
103+
{
104+
"source_path": "defender-endpoint/download-client-analyzer.md",
105+
"redirect_url": "/defender-endpoint/overview-client-analyzer",
106+
"redirect_document_id": false
107+
},
108+
{
109+
"source_path": "defender-endpoint/comprehensive-guidance-on-linux-deployment.md",
110+
"redirect_url": "/defender-endpoint/linux-installer-script",
111+
"redirect_document_id": true
87112
}
88113
]
89114
}

.openpublishing.redirection.defender-xdr.json

Lines changed: 56 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -259,6 +259,61 @@
259259
"source_path": "defender-xdr/microsoft-sentinel-onboard.md",
260260
"redirect_url": "/unified-secops-platform/microsoft-sentinel-onboard",
261261
"redirect_document_id": false
262-
}
262+
},
263+
{
264+
"source_path": "defender-xdr/first-incident-path-phishing.md",
265+
"redirect_url": "/security/operations/incident-response-playbook-phishing",
266+
"redirect_document_id": false
267+
},
268+
{
269+
"source_path": "defender-xdr/first-incident-path-identity.md",
270+
"redirect_url": "/defender-for-identity/manage-security-alerts",
271+
"redirect_document_id": false
272+
},
273+
{
274+
"source_path": "defender-xdr/incident-response-overview.md",
275+
"redirect_url": "/defender-xdr/incidents-overview",
276+
"redirect_document_id": true
277+
},
278+
{
279+
"source_path": "defender-xdr/respond-first-incident-analyze.md",
280+
"redirect_url": "/defender-xdr/investigate-incidents",
281+
"redirect_document_id": true
282+
},
283+
{
284+
"source_path": "defender-xdr/respond-first-incident-365-defender.md",
285+
"redirect_url": "/defender-xdr/manage-incidents",
286+
"redirect_document_id": true
287+
},
288+
{
289+
"source_path": "defender-xdr/export-incidents-queue.md",
290+
"redirect_url": "/defender-xdr/incident-queue",
291+
"redirect_document_id": true
292+
},
293+
{
294+
"source_path": "defender-xdr/respond-first-incident-remediate.md",
295+
"redirect_url": "/defender-xdr/incidents-overview",
296+
"redirect_document_id": false
297+
},
298+
{
299+
"source_path": "defender-xdr/m365d-time-zone.md",
300+
"redirect_url": "/defender-xdr/m365d-enable-faq",
301+
"redirect_document_id": true
302+
},
303+
{
304+
"source_path": "defender-xdr/feedback.md",
305+
"redirect_url": "/defender-xdr/m365d-enable-faq",
306+
"redirect_document_id": false
307+
},
308+
{
309+
"source_path": "defender-xdr/microsoft-365-defender-integration-with-azure-sentinel.md",
310+
"redirect_url": "/azure/sentinel/microsoft-365-defender-sentinel-integration",
311+
"redirect_document_id": false
312+
},
313+
{
314+
"source_path": "defender-xdr/microsoft-365-security-center-defender-cloud.md",
315+
"redirect_url": "/azure/defender-for-cloud/concept-integration-365",
316+
"redirect_document_id": false
317+
}
263318
]
264319
}

ATPDocs/deploy/activate-capabilities.md

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,20 +7,20 @@ ms.topic: how-to
77

88
# Activate Microsoft Defender for Identity capabilities directly on a domain controller
99

10-
Microsoft Defender for Endpoint customers, who have already onboarded their domain controllers to Defender for Endpoint, can activate Microsoft Defender for Identity capabilities directly on a domain controller instead of using a [Microsoft Defender for Identity sensor](deploy-defender-identity.md).
10+
Microsoft Defender for Endpoint customers, who have already onboarded their domain controllers to Defender for Endpoint, can activate Microsoft Defender for Identity capabilities directly on a domain controller instead of using [Microsoft Defender for Identity classic sensor](deploy-defender-identity.md).
1111

1212
This article describes how to activate and test Microsoft Defender for Identity capabilities on your domain controller.
1313

1414
> [!IMPORTANT]
15-
> The new sensor is recommended for customers looking to deploy core identity protections to new domain controllers running Windows Server 2019 or newer. For all other identity infrastructure, or for customers looking to deploy the most robust identity protections available from Microsoft Defender for Identity today, we recommend deploying the classic sensor [here](quick-installation-guide.md).
15+
> The new Defender for Identity sensor (version 3.x) is recommended for customers looking to deploy core identity protections to new domain controllers running Windows Server 2019 or newer. For all other identity infrastructure, or for customers looking to deploy the most robust identity protections available from Microsoft Defender for Identity today, we recommend deploying the classic sensor [here](quick-installation-guide.md).
1616
1717
## Prerequisites
1818

1919
Before activating the Defender for Identity capabilities on your domain controller, make sure that your environment complies with the prerequisites in this section.
2020

2121
### Defender for Identity sensor conflicts
2222

23-
The configuration described in this article doesn't support side-by-side installation with an existing Defender for Identity sensor, and isn't recommended as a replacement for the Defender for Identity sensor.
23+
The configuration described in this article doesn't support side-by-side installation with an existing Defender for Identity sensor, and isn't recommended as a replacement for the Defender for Identity classic sensor.
2424

2525
Make sure that the domain controller where you're planning to activate Defender for Identity capabilities doesn't have a [Defender for Identity sensor](deploy-defender-identity.md) deployed.
2626

@@ -88,12 +88,16 @@ Activate the Defender for Identity from the [Microsoft Defender portal](https://
8888

8989
The Activation page lists servers discovered in Device Inventory and identified as eligible domain controllers.
9090

91-
2. Select the domain controller where you want to activate the Defender for Identity capabilities and then select **Activate**. Confirm your selection when prompted.
91+
1. Select the domain controller where you want to activate the Defender for Identity capabilities and then select **Activate**. Confirm your selection when prompted.
92+
93+
:::image type="content" source="media/activate-capabilities/1.jpg" lightbox="media/activate-capabilities/1.jpg" alt-text="Screenshot that shows how to activate the new sensor.":::
9294

9395
> [!NOTE]
9496
> You can choose to activate eligible domain controllers either automatically, where Defender for Identity activates them as soon as they're discovered, or manually, where you select specific domain controllers from the list of eligible servers.
9597
96-
3. When the activation is complete, a green success banner shows. In the banner, select **Click here to see the onboarded servers** to jump to the **Settings > Identities > Sensors** page, where you can check your sensor health.
98+
1. When the activation is complete, a green success banner shows. In the banner, select **Click here to see the onboarded servers** to jump to the **Settings > Identities > Sensors** page, where you can check your sensor health.
99+
100+
:::image type="content" source="media/activate-capabilities/2.jpg" lightbox="media/activate-capabilities/2.jpg" alt-text="Screenshot that shows how to seethe onboarded servers.":::
97101

98102
## Onboarding Confirmation
99103

@@ -104,7 +108,7 @@ To confirm the sensor has been onboarded:
104108
2. Check that the onboarded domain controller is listed.
105109

106110
> [!NOTE]
107-
> The activation doesn't require a restart/reboot. The first time you activate Defender for Identity capabilities on your domain controller, it may take up to an hour for the first sensor to show as **Running** on the **Sensors** page. Subsequent activations are shown within five minutes.
111+
> The activation doesn't require a restart/reboot. The first time you activate Defender for Identity capabilities on your domain controller, it may take up to an hour for the first sensor to show as **Running** on the **Sensors** page. Subsequent activations are shown within five minutes.
108112
109113
## Test activated capabilities
110114

@@ -126,7 +130,6 @@ In the Defender portal, select **Identities** > **Dashboard**, and review the de
126130

127131
For more information, see [Work with Defender for Identity's ITDR dashboard](../dashboard.md).
128132

129-
130133
### Confirm entity page details
131134

132135
Confirm that entities, such as domain controllers, users, and groups, are populated as expected.
@@ -139,7 +142,7 @@ In the Defender portal, check for the following details:
139142

140143
- **Group entities**: Use the global search to find a user group, or pivot from a user or device details page where group details are shown. Check for details of group membership, view group users, and group timeline data.
141144

142-
If no event data is found on the group timeline, you may need to create some manually. For example, do this by adding and removing users from the group in Active Directory.
145+
If no event data is found on the group timeline, you may need to create some manually. For example, do this by adding and removing users from the group in Active Directory.
143146

144147
For more information, see [Investigate assets](../investigate-assets.md).
145148

@@ -205,18 +208,20 @@ Test remediation actions on a test user. For example:
205208
206209
1. In the Defender portal, go to the user details page for a test user.
207210
208-
1. From the **Options** menu, select any of the available remediation actions.
211+
2. From the **Options** menu, select any of the available remediation actions.
209212
210-
1. Check Active Directory for the expected activity.
213+
3. Check Active Directory for the expected activity.
211214
212215
For more information, see [Remediation actions in Microsoft Defender for Identity](../remediation-actions.md).
213216
214217
## Deactivate Defender for Identity capabilities on your domain controller
215218
216219
If you want to deactivate Defender for Identity capabilities on your domain controller, delete it from the **Sensors** page:
217220
218-
1. In the Defender portal, select **Settings > Identities > Sensors**.
219-
1. Select the domain controller where you want to deactivate Defender for Identity capabilities, select **Delete**, and confirm your selection.
221+
1. In the Defender portal, select **Settings** > **Identities** > **Sensors**.
222+
2. Select the domain controller where you want to deactivate Defender for Identity capabilities, select **Delete**, and confirm your selection.
223+
224+
:::image type="content" source="media/activate-capabilities/3.jpg" lightbox="media/activate-capabilities/3.jpg" alt-text="Screenshot that shows how to deactivate a server.":::
220225
221226
Deactivating Defender for Identity capabilities from your domain controller doesn't remove the domain controller from Defender for Endpoint. For more information, see [Defender for Endpoint documentation](/microsoft-365/security/defender-endpoint/).
222227
186 KB
Loading
144 KB
Loading
169 KB
Loading

ATPDocs/health-alerts.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,12 @@ This section describes all the health issues for each component, listing the cau
3939

4040
Sensor-specific health issues are displayed in the **Sensor health issues** tab and domain related or aggregated health issues are displayed in the **Global health issues** tab as detailed in the following tables:
4141

42+
### Network configuration mismatch for sensors running on VMware
43+
44+
|Alert|Description|Resolution|Severity|Displayed in|
45+
|----|----|----|----|----|
46+
|The virtual machines that the listed Defender for Identity sensors are installed on has a network configuration mismatch. This issue may affect the performance and reliability of the sensors.|Review the network interface settings, including disabling the Large Send Offload (LSO), and follow the instructions in [here](https://aka.ms/mdi/vmware-sensor-issue).|High|Sensors health issues tab|
47+
4248
### A domain controller is unreachable by a sensor
4349

4450
|Alert|Description|Resolution|Severity|Displayed in|

ATPDocs/identity-inventory.md

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
---
2+
# Required metadata
3+
# For more information, see https://review.learn.microsoft.com/en-us/help/platform/learn-editor-add-metadata?branch=main
4+
# For valid values of ms.service, ms.prod, and ms.topic, see https://review.learn.microsoft.com/en-us/help/platform/metadata-taxonomies?branch=main
5+
6+
title: Identity inventory
7+
description: The Identity Inventory provides a centralized location for customers to view and manage identity information across their environment, ensuring optimal visibility and a comprehensive experience. The updated Identities Inventory page, located under Assets in Defender XDR portal
8+
author: LiorShapiraa # GitHub alias
9+
ms.author: liorshapira
10+
ms.service: microsoft-defender-for-identity
11+
ms.topic: article
12+
ms.date: 03/13/2025
13+
---
14+
15+
# Identity inventory
16+
17+
__Applies to:__
18+
19+
- [Microsoft Defender for Identity](https://aka.ms/aatp/docs)
20+
21+
- [Microsoft Defender for Cloud Apps](/defender-cloud-apps/)
22+
23+
- [Microsoft Defender XDR](/defender-xdr)
24+
25+
The __Identity inventory__ provides a centralized view of all identities in your organization, enabling you to monitor and manage them efficiently. At a glance, you can see key details such as Domain, Tags, Type, and other attributes, helping you quickly identify and manage identities that require attention.
26+
27+
The Identities inventory page includes the following tabs:
28+
29+
- **Identities**: A consolidated view of identities across Active Directory, Entra ID. This Identities tab highlights key details, including identity types, and user's information.
30+
31+
- **Cloud application accounts:** Displays a list of cloud application accounts, including those from application connectors and third-party sources (original available in the previous version based on Microsoft Defender for Cloud Apps). Learn more about [Cloud application accounts from connected apps.](/defender-cloud-apps/accounts)
32+
33+
There are several options you can choose from to customize the identities list view. On the top navigation you can:
34+
35+
- Add or remove columns.
36+
37+
- Apply filters.
38+
39+
- Search for an identity by name or full UPN, Sid and Object ID.
40+
41+
- Export the list to a CSV file.
42+
43+
- Copy list link with the included filters configured.
44+
45+
## ![A screenshot of identity inventory page.](media/identity-inventory/inventory11.png)
46+
47+
### Identity details
48+
49+
The **Identities** list offers a consolidated view of identities across Active Directory and Entra ID. It highlights key details, including the following columns by default:
50+
51+
- __Display name__ – The full name of the identity as shown in the directory.
52+
53+
- __SID__ – The Security Identifier, a unique value used to identify the identity in Active Directory.
54+
55+
- __Domain__ – The Active Directory domain to which the identity belongs.
56+
57+
- __Object ID__ – A unique identifier for the identity in Entra ID.
58+
59+
- __Source__ – Indicates whether the identity is on-premises (originate from Active Directory), Cloud only (Entra ID) or Hybrid (synced from AD to Entra ID).
60+
61+
- __Type__ – Specifies if the identity is a user account or service account.
62+
63+
- __UPN (User Principal Name)__ – The unique login name of the identity in an email-like format.
64+
65+
- __Tags__ – Custom labels that help categorize or classify identities: Sensitive and Honeytoken.
66+
67+
- __Created time__ – The timestamp when the identity was first created.
68+
69+
- __Criticality level__ – Indicates the critical level of the identity.
70+
71+
- __Account status__ – Shows whether the identity is enabled or disabled.
72+
73+
- __Last updated__ – The timestamp of the most recent update to the identity's attributes in Active Directory.
74+
75+
Non-default columns: Email and Entra ID risk level.  
76+
77+
> [!TIP]
78+
> To see all columns, you likely need to do one or more of the following steps:
79+
> - Horizontally scroll in your web browser.
80+
> - Narrow the width of appropriate columns.
81+
> - Zoom out in your web browser.
82+
83+
### Sort and filter the Identities list
84+
85+
You can apply the following filters to limit the list of identities and get a more focused view:
86+
87+
- Domain
88+
89+
- Type
90+
91+
- Source
92+
93+
- Tags
94+
95+
- Criticality level
96+
97+
- Account status
98+
99+
Sort option applies to Display name, Domain and Created time columns.
100+
101+
### Identity inventory insights
102+
103+
- The __Classify critical assets__ card allows you to define identity groups as business critical. For more information, see [Microsoft Security Exposure Management](/security-exposure-management/microsoft-security-exposure-management).
104+
105+
- **Highly privileged identities** card helps you investigate in Advanced hunting all sensitive accounts in your organization, including Entra ID security administrators and Global admin users.
106+
107+
- **Critical Active Directory service accounts** card helps you quickly identify all Active Directory accounts designated as critical, making it easier to focus on identities most at risk.
108+
109+
At the top of each device inventory tab, the following device counts are available:
110+
111+
- __Total__: The total number of identities.
112+
113+
- __Critical:__ The number of your critical assets.
114+
115+
- **Disabled:** The number of all disabled identities in your organization.
116+
117+
- **Services:** The number of all service accounts both on-premises and cloud.
118+
119+
You can use this information to help you prioritize devices for security posture improvements.
120+
121+
### Navigate to the Identity inventory page
122+
123+
Use relative links instead of absolute links.
124+
In the Defender XDR portal at [https://security.microsoft.com](https://security.microsoft.com), go to Assets > Identities. Or, to navigate directly to the [identity inventory](/defender-for-identity/identity-inventory) page.
125+
126+
### Related Articles
127+
128+
- [Investigate cloud application accounts](/defender-cloud-apps/accounts)
129+
130+
- [Investigate users in Microsoft Defender XDR](/defender-xdr/investigate-users)
131+
132+
- [Investigate assets in Microsoft Defender for Identity](/defender-for-identity/investigate-assets)
133+

0 commit comments

Comments
 (0)