Merge pull request #3975 from MicrosoftDocs/main

Ruchika-mittal01 · web-flow · commit 4295dde4d457 · 2025-05-29T04:08:00.000+05:30
[AutoPublish] main to live - 05/28 15:32 PDT | 05/29 04:02 IST
diff --git a/defender-business/mdb-add-users.md b/defender-business/mdb-add-users.md
@@ -6,7 +6,7 @@ author: chrisda
 ms.author: chrisda
 manager: deniseb
 audience: Admin
-ms.topic: conceptual
+ms.topic: how-to
 ms.service: defender-business
 ms.localizationpriority: medium
 ms.date: 06/19/2024
diff --git a/defender-business/mdb-asr.md b/defender-business/mdb-asr.md
@@ -5,7 +5,7 @@ author: chrisda
 ms.author: chrisda
 manager: deniseb
 ms.date: 07/23/2024
-ms.topic: conceptual
+ms.topic: how-to
 ms.service: defender-business
 ms.localizationpriority: medium
 ms.collection:
diff --git a/defender-business/mdb-attack-disruption.md b/defender-business/mdb-attack-disruption.md
@@ -5,7 +5,7 @@ author: chrisda
 ms.author: chrisda
 manager: deniseb
 ms.date: 06/07/2024
-ms.topic: conceptual
+ms.topic: article
 ms.service: defender-business
 ms.localizationpriority: medium
 ms.collection:
diff --git a/defender-business/mdb-controlled-folder-access.md b/defender-business/mdb-controlled-folder-access.md
@@ -5,7 +5,7 @@ author: chrisda
 ms.author: chrisda
 manager: deniseb
 ms.date: 06/07/2024
-ms.topic: conceptual
+ms.topic: how-to
 ms.service: defender-business
 ms.localizationpriority: medium
 ms.collection:
diff --git a/defender-business/mdb-get-started.md b/defender-business/mdb-get-started.md
@@ -6,7 +6,7 @@ author: chrisda
 ms.author: chrisda
 manager: deniseb
 audience: Admin
-ms.topic: conceptual
+ms.topic: get-started
 ms.service: defender-business
 ms.localizationpriority: medium
 ms.date: 07/03/2024
diff --git a/defender-business/mdb-mtd.md b/defender-business/mdb-mtd.md
@@ -5,7 +5,7 @@ author: chrisda
 ms.author: chrisda
 manager: deniseb
 ms.date: 07/23/2024
-ms.topic: conceptual
+ms.topic: article
 ms.service: defender-business
 ms.localizationpriority: medium
 ms.collection:
diff --git a/defender-endpoint/investigate-machines.md b/defender-endpoint/investigate-machines.md
@@ -14,7 +14,7 @@ ms.collection:
 ms.topic: conceptual
 ms.subservice: edr
 search.appverid: met150
-ms.date: 03/26/2025
+ms.date: 05/28/2025
 ---
 
 # Investigate devices in the Microsoft Defender for Endpoint Devices list
@@ -50,7 +50,7 @@ When you investigate a specific device, you see:
 :::image type="content" source="media/specific-device.png" alt-text="The device view" lightbox="media/specific-device.png":::
 
 > [!NOTE]
-> Due to product constrains, the device profile does not consider all cyber evidence when determining the 'Last Seen' timeframe (as seen on the device page as well).
+> Due to product constraints, the device profile doesn't consider all cyber evidence when determining the 'Last Seen' timeframe (as seen on the device page as well).
 > For example, the 'Last seen' value in the Device page may show an older time frame even though more recent alerts or data is available in the machine's timeline.
 
 ## Device details
@@ -152,16 +152,26 @@ To further inspect the event and related events, you can quickly run an [advance
 
 **Security recommendations** are generated from Microsoft Defender for Endpoint's [Vulnerability Management](/defender-vulnerability-management/tvm-dashboard-insights) capability. Selecting a recommendation shows a panel where you can view relevant details such as description of the recommendation and the potential risks associated with not enacting it. See [Security recommendation](api/ti-indicator.md) for details.
 
+### Configuration management - Security policies
 
+The **Security policies** tab shows the endpoint security policies that are applied on the device. You see a list of policies, type, status, and last check-in time. Selecting the name of a policy takes you to the policy details page where you can see the policy settings status, applied devices, and assigned groups.
 
+:::image type="content" source="media/mde-security-policies.png" alt-text="Screenshot showing the Security policies tab." lightbox="media/mde-security-policies.png":::
 
-### Security policies
+### Configuration management - Effective settings
 
-The **Security policies** tab shows the endpoint security policies that are applied on the device. You see a list of policies, type, status, and last check-in time. Selecting the name of a policy takes you to the policy details page where you can see the policy settings status, applied devices, and assigned groups.
+The **Effective settings** tab provides visibility into the actual value of each security setting and identifies the source that configured it. It lists setting names, policy types, effective values, the source of each effective value, and the last report time.
 
+Configuration sources can include tools like Microsoft Defender for Endpoint, Group Policy, Intune, or default settings. They can also be specific registry paths, such as the MDM or Group Policy hives. If the source is a registry location, the Configured By field shows as **Unknown** along with the registry path.
+ 
+Select a setting to open a side panel with more details. You see the current value, any other configuration attempts that didn’t take effect, and—for complex settings like ASR rules or AV exclusions—a breakdown of all configured rules, their sources, and any exclusions.
+ 
+> [!NOTE]
+> The presented settings are AV security settings, Attack Surface Reduction rules, and exclusions, for Windows platforms.
 
-:::image type="content" source="media/security-policies-tab.png" alt-text="The Security policies tab" lightbox="media/security-policies-tab.png":::
+:::image type="content" source="media/mde-effective-settings.png" alt-text="Screenshot showing the Effective settings tab." lightbox="media/mde-effective-settings.png":::
 
+:::image type="content" source="media/mde-effective-settings-open.png" alt-text="Screenshot showing the opened Effective settings value tab." lightbox="media/mde-effective-settings-open.png":::
 
 ### Software inventory
 
diff --git a/defender-endpoint/manage-security-policies.md b/defender-endpoint/manage-security-policies.md
@@ -12,7 +12,7 @@ ms.collection:
 - tier2
 ms.topic: how-to
 search.appverid: met150
-ms.date: 08/05/2024
+ms.date: 05/28/2025
 ---
 
 # Manage endpoint security policies in Microsoft Defender for Endpoint
@@ -100,7 +100,7 @@ To verify that you have successfully created a policy, select a policy name from
 
 The policy page displays details that summarize the status of the policy. You can view a policy's status, which devices it has been applied to, and assigned groups.
 
-During an investigation, you can also view the **Security policies** tab in the device page to view the list of policies that are being applied to a particular device. For more information, see [Investigating devices](investigate-machines.md#security-policies).
+During an investigation, you can also view the **Security policies** tab in the device page to view the list of policies that are being applied to a particular device. For more information, see [Investigating devices](investigate-machines.md).
 
 :::image type="content" source="./media/security-policies-list.png" alt-text="Security policies tab with list of policies":::
 
diff --git a/defender-endpoint/mde-security-settings-management.md b/defender-endpoint/mde-security-settings-management.md
@@ -8,7 +8,7 @@ manager: deniseb
 ms.service: defender-endpoint
 ms.subservice: ngp
 ms.topic: how-to
-ms.date: 05/24/2025
+ms.date: 05/28/2025
 ms.collection: 
 - m365-security
 - tier2
@@ -114,7 +114,7 @@ To verify that you have successfully created a policy, select a policy name from
 
 The policy page displays details that summarize the status of the policy. You can view a policy's status, which devices it is applied to, and assigned groups.
 
-During an investigation, you can also view the **Security policies** tab in the device page to view the list of policies that are being applied to a particular device. For more information, see [Investigating devices](investigate-machines.md#security-policies).
+During an investigation, you can also view the **Security policies** tab in the device page to view the list of policies that are being applied to a particular device. For more information, see [Investigating devices](investigate-machines.md).
 
 :::image type="content" source="./media/security-policies-list.png" alt-text="Security policies tab with list of policies" lightbox="./media/security-policies-list.png":::
 
diff --git a/defender-endpoint/media/mde-effective-settings-open.png b/defender-endpoint/media/mde-effective-settings-open.png
diff --git a/defender-endpoint/media/mde-effective-settings.png b/defender-endpoint/media/mde-effective-settings.png
diff --git a/defender-endpoint/media/mde-security-policies.png b/defender-endpoint/media/mde-security-policies.png
diff --git a/defender-office-365/address-compromised-users-quickly.md b/defender-office-365/address-compromised-users-quickly.md
@@ -4,7 +4,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: how-to
 ms.localizationpriority: medium
 search.appverid:
   - MET150
diff --git a/defender-office-365/air-about.md b/defender-office-365/air-about.md
@@ -6,7 +6,7 @@ author: chrisda
 ms.author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: article
 ms.date: 01/10/2025
 ms.localizationpriority: medium
 search.appverid:
diff --git a/defender-office-365/air-remediation-actions.md b/defender-office-365/air-remediation-actions.md
@@ -6,7 +6,7 @@ author: chrisda
 ms.author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: article
 ms.localizationpriority: medium
 search.appverid: 
 - MET150
diff --git a/defender-office-365/air-view-investigation-results.md b/defender-office-365/air-view-investigation-results.md
@@ -6,7 +6,7 @@ author: chrisda
 ms.author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: article
 ms.localizationpriority: medium
 search.appverid: 
 - MET150
diff --git a/defender-office-365/anti-spam-bulk-senders-insight.md b/defender-office-365/anti-spam-bulk-senders-insight.md
@@ -6,7 +6,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: article
 ms.localizationpriority: medium
 search.appverid: 
   - MET150
diff --git a/defender-office-365/anti-spam-policies-asf-settings-about.md b/defender-office-365/anti-spam-policies-asf-settings-about.md
@@ -6,7 +6,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: article
 ms.localizationpriority: medium
 search.appverid: 
   - MET150
diff --git a/defender-office-365/anti-spam-spam-confidence-level-scl-about.md b/defender-office-365/anti-spam-spam-confidence-level-scl-about.md
@@ -6,7 +6,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: article
 ms.localizationpriority: medium
 search.appverid: 
   - MET150
diff --git a/defender-office-365/anti-spam-spam-vs-bulk-about.md b/defender-office-365/anti-spam-spam-vs-bulk-about.md
@@ -6,7 +6,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: article
 ms.localizationpriority: medium
 search.appverid: 
   - MET150
diff --git a/defender-office-365/campaigns.md b/defender-office-365/campaigns.md
@@ -7,7 +7,7 @@ author: chrisda
 manager: deniseb
 ms.reviewer: mcostea
 audience: ITPro
-ms.topic: conceptual
+ms.topic: article
 ms.localizationpriority: medium
 search.appverid: 
   - MET150
diff --git a/defender-office-365/detect-and-remediate-illicit-consent-grants.md b/defender-office-365/detect-and-remediate-illicit-consent-grants.md
@@ -6,7 +6,7 @@ author: chrisda
 ms.author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: how-to
 ms.collection:
 - tier2
 - m365-security
diff --git a/defender-office-365/detect-and-remediate-outlook-rules-forms-attack.md b/defender-office-365/detect-and-remediate-outlook-rules-forms-attack.md
@@ -7,7 +7,7 @@ ms.author: chrisda
 manager: deniseb
 ms.date: 9/7/2023
 audience: ITPro
-ms.topic: conceptual
+ms.topic: how-to
 ms.collection:
   - tier2
   - m365-security
diff --git a/defender-office-365/email-authentication-about.md b/defender-office-365/email-authentication-about.md
@@ -6,7 +6,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: how-to
 search.appverid:
   - MET150
 ms.assetid:
diff --git a/defender-office-365/email-authentication-arc-configure.md b/defender-office-365/email-authentication-arc-configure.md
@@ -6,7 +6,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: how-to
 ms.localizationpriority: high
 search.appverid:
   - MET150
diff --git a/defender-office-365/email-authentication-dkim-configure.md b/defender-office-365/email-authentication-dkim-configure.md
@@ -7,7 +7,7 @@ author: chrisda
 manager: deniseb
 ms.date: 04/14/2025
 audience: ITPro
-ms.topic: conceptual
+ms.topic: how-to
 
 ms.localizationpriority: high
 search.appverid:
diff --git a/defender-office-365/email-authentication-dmarc-configure.md b/defender-office-365/email-authentication-dmarc-configure.md
@@ -6,7 +6,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: how-to
 ms.date: 05/07/2025
 ms.localizationpriority: high
 search.appverid:
diff --git a/defender-office-365/external-senders-policies-practices-guidelines.md b/defender-office-365/external-senders-policies-practices-guidelines.md
@@ -6,7 +6,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: article
 ms.localizationpriority: medium
 search.appverid: 
   - MET150
diff --git a/defender-office-365/how-policies-and-protections-are-combined.md b/defender-office-365/how-policies-and-protections-are-combined.md
@@ -7,7 +7,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: reference
 ms.localizationpriority: medium
 ms.collection: 
   - m365-security
diff --git a/defender-office-365/mdo-about.md b/defender-office-365/mdo-about.md
@@ -4,7 +4,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: Admin
-ms.topic: conceptual
+ms.topic: overview
 ms.localizationpriority: high
 search.appverid: 
   - MET150
diff --git a/defender-office-365/mdo-deployment-guide.md b/defender-office-365/mdo-deployment-guide.md
@@ -6,7 +6,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: Admin
-ms.topic: conceptual
+ms.topic: get-started
 ms.localizationpriority: medium
 search.appverid: 
   - MET150
diff --git a/defender-office-365/mdo-email-entity-page.md b/defender-office-365/mdo-email-entity-page.md
@@ -7,7 +7,7 @@ author: chrisda
 manager: deniseb
 ms.date: 01/16/2025
 audience: ITPro
-ms.topic: conceptual
+ms.topic: article
 ms.service: defender-office-365
 ms.localizationpriority: medium
 ms.collection:
diff --git a/defender-office-365/mdo-integrate-security-service.md b/defender-office-365/mdo-integrate-security-service.md
@@ -6,7 +6,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: Admin
-ms.topic: conceptual
+ms.topic: how-to
 ms.localizationpriority: medium
 search.appverid: 
   - MET150
diff --git a/defender-office-365/mdo-portal-permissions.md b/defender-office-365/mdo-portal-permissions.md
@@ -6,7 +6,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 ms.audience: Admin
-ms.topic: conceptual
+ms.topic: how-to
 audience: Admin
 ms.localizationpriority: high
 ms.collection: 
diff --git a/defender-office-365/mdo-sec-ops-guide.md b/defender-office-365/mdo-sec-ops-guide.md
@@ -6,7 +6,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: Admin
-ms.topic: conceptual
+ms.topic: how-to
 ms.localizationpriority: medium
 search.appverid:
   - MET150
diff --git a/defender-office-365/message-headers-eop-mdo.md b/defender-office-365/message-headers-eop-mdo.md
@@ -6,7 +6,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: article
 
 ms.localizationpriority: high
 search.appverid: 
diff --git a/defender-office-365/pim-in-mdo-configure.md b/defender-office-365/pim-in-mdo-configure.md
@@ -7,7 +7,7 @@ ms.author: chrisda
 manager: deniseb
 ms.date: 2/20/2024
 audience: ITPro
-ms.topic: conceptual
+ms.topic: how-to
 ms.localizationpriority: high
 search.appverid:
   - MET150
diff --git a/defender-office-365/protection-stack-microsoft-defender-for-office365.md b/defender-office-365/protection-stack-microsoft-defender-for-office365.md
@@ -8,7 +8,7 @@ manager: deniseb
 ms.date: 02/24/2025
 ms.reviewer: gigarrub
 audience: ITPro
-ms.topic: conceptual
+ms.topic: how-to
 ms.localizationpriority: medium
 description: Follow the path of an incoming message through the threat filtering stack in Microsoft Defender for Office 365.
 ms.service: defender-office-365
diff --git a/defender-office-365/quarantine-quarantine-notifications.md b/defender-office-365/quarantine-quarantine-notifications.md
@@ -6,7 +6,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: Admin
-ms.topic: conceptual
+ms.topic: article
 ms.localizationpriority: medium
 search.appverid:
   - MOE150
diff --git a/defender-office-365/recommended-settings-for-eop-and-office365.md b/defender-office-365/recommended-settings-for-eop-and-office365.md
@@ -7,7 +7,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: article
 ms.localizationpriority: medium
 search.appverid:
   - MET150
diff --git a/defender-office-365/reports-email-security.md b/defender-office-365/reports-email-security.md
@@ -6,7 +6,7 @@ ms.author: chrisda
 author: chrisda
 manager: deniseb
 audience: ITPro
-ms.topic: conceptual
+ms.topic: how-to
 ms.localizationpriority: medium
 search.appverid:
   - MET150
diff --git a/defender-office-365/scc-permissions.md b/defender-office-365/scc-permissions.md
diff --git a/defender-office-365/teams-message-entity-panel.md b/defender-office-365/teams-message-entity-panel.md
diff --git a/defender-office-365/threat-explorer-email-security.md b/defender-office-365/threat-explorer-email-security.md
diff --git a/defender-office-365/threat-explorer-investigate-delivered-malicious-email.md b/defender-office-365/threat-explorer-investigate-delivered-malicious-email.md
diff --git a/defender-office-365/threat-explorer-threat-hunting.md b/defender-office-365/threat-explorer-threat-hunting.md
diff --git a/defender-office-365/trial-user-guide-defender-for-office-365.md b/defender-office-365/trial-user-guide-defender-for-office-365.md
diff --git a/defender-office-365/try-microsoft-defender-for-office-365.md b/defender-office-365/try-microsoft-defender-for-office-365.md
diff --git a/defender-office-365/zero-hour-auto-purge.md b/defender-office-365/zero-hour-auto-purge.md
diff --git a/defender-office-365/zero-trust-with-microsoft-365-defender-office-365.md b/defender-office-365/zero-trust-with-microsoft-365-defender-office-365.md
