You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/behaviors.md
+4-5Lines changed: 4 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,6 +22,9 @@ Behaviors are attached to MITRE attack categories and techniques, and provide a
22
22
23
23
While behaviors might be related to security scenarios, they're not necessarily a sign of malicious activity or a security incident. Each behavior is based on one or more raw events, and provides contextual insights into what occurred at a specific time, using information that Defender for Cloud Apps as learned or identified.
24
24
25
+
> [!IMPORTANT]
26
+
> Starting March 2025, Defender for Cloud Apps customers can configure Role-Based Access Control (RBAC) scoping for 'Behaviors.' This new capability empowers administrators to define and manage access permissions more precisely. Administrators can ensure that users have the appropriate level of access to specific application data based on their roles and responsibilities. For more information, see [how to configure admin access](/defender-cloud-apps/manage-admins).
27
+
25
28
## Supported detections
26
29
27
30
Behaviors currently support low-fidelity, Defender for Cloud Apps detections, that may not meet the standard for alerts but are still useful in providing context during an investigation. Currently supported detections include:
@@ -121,7 +124,7 @@ BehaviorInfo
121
124
122
125
### Investigate behaviors for a specific user
123
126
124
-
**Scenario**: Investigate all behaviors related to a specific user after understanding the user may have been compromised.
127
+
**Scenario**: Investigate all behaviors related to a specific user after understanding the user might have been compromised.
125
128
126
129
Use the following query, where *username* is the name of the user you want to investigate:
### Role-Based Access Control (RBAC) scoping for 'Behaviors'
151
-
152
-
Starting March 2025, Defender for Cloud Apps customers can configure Role-Based Access Control (RBAC) scoping for 'Behaviors'. This new capability empowers administrators to define and manage access permissions more precisely, ensuring that users have the appropriate level of access to specific application data based on their roles and responsibilities. Read more here on how to configure - [Configure admin access](https://learn.microsoft.com/defender-cloud-apps/manage-admins).
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/protect-office-365.md
+14-9Lines changed: 14 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ ms.topic: how-to
8
8
9
9
10
10
11
-
As a major productivity suite providing cloud file storage, collaboration, BI, and CRM tools, Microsoft 365 enables your users to share their documents across your organization and partners in a streamlined and efficient way. Using Microsoft 365 may expose your sensitive data not only internally, but also to external collaborators, or even worse make it publicly available via a shared link. Such incidents might occur due to malicious actor, or by an unaware employee. Microsoft 365 also provides a large third-party app eco-system to help boost productivity. Using these apps can expose your organization to the risk of malicious apps or use of apps with excessive permissions.
11
+
As a major productivity suite providing cloud file storage, collaboration, BI, and CRM tools, Microsoft 365 enables your users to share their documents across your organization and partners in a streamlined and efficient way. Using Microsoft 365 might expose your sensitive data not only internally, but also to external collaborators, or even worse make it publicly available via a shared link. Such incidents might occur due to malicious actor, or by an unaware employee. Microsoft 365 also provides a large third-party app eco-system to help boost productivity. Using these apps can expose your organization to the risk of malicious apps or use of apps with excessive permissions.
12
12
13
13
Connecting Microsoft 365 to Defender for Cloud Apps gives you improved insights into your users' activities, provides threat detection using machine learning based anomaly detections, information protection detections (such as detecting external information sharing), enables automated remediation controls, and detects threats from enabled third-party apps in your organization.
14
14
@@ -17,7 +17,11 @@ Defender for Cloud Apps integrates directly with [Microsoft 365's audit logs](/m
To enhance file scanning efficiency and accuracy within Microsoft 365 environments, Defender for Cloud Apps has updated the file scanning process for Microsoft 365. Unless you activate information protection policies, Defender for Cloud Apps won't scan or store organizational files.
23
+
24
+
When you actively use information protection policies, organizational files might have significant scanning durations due to high volumes of file scanning activities.
21
25
22
26
Defender for Cloud Apps has added new file scanning improvements for SharePoint and OneDrive:
23
27
@@ -26,7 +30,7 @@ Defender for Cloud Apps has added new file scanning improvements for SharePoint
26
30
- Better identification for a file's access level in SharePoint: file access level in SharePoint will be marked by default as **Internal**, and not as **Private** (since every file in SharePoint is accessible by the site owner, and not only by the file owner).
27
31
28
32
>[!NOTE]
29
-
>This change could impact your file policies (if a file policy is looking for **Internal** or **Private** files in SharePoint).
33
+
>This change could affect your file policies (if a file policy is looking for **Internal** or **Private** files in SharePoint).
30
34
31
35
## Main threats
32
36
@@ -79,7 +83,7 @@ Review our best practices for [securing and collaborating with external users](b
79
83
80
84
## Defender for Cloud Apps integration with Microsoft 365
81
85
82
-
Defender for Cloud Apps supports the legacy Microsoft 365 Dedicated Platform as well as the latest offerings of Microsoft 365 services, commonly referred as the *vNext* release family of Microsoft 365.
86
+
Defender for Cloud Apps supports the legacy Microsoft 365 Dedicated Platform and the latest offerings of Microsoft 365 services, commonly referred as the *vNext* release family of Microsoft 365.
83
87
84
88
In some cases, a vNext service release differs slightly at the administrative and management levels from the standard Microsoft 365 offering.
85
89
@@ -115,7 +119,9 @@ This section provides instructions for connecting Microsoft Defender for Cloud A
- To enable file monitoring of Microsoft 365 files, you must use a relevant Entra Admin ID, such as Application Administrator or Cloud Application Administrator. For more information, see [Microsoft Entra built-in roles](/entra/identity/role-based-access-control/permissions-reference)
119
125
120
126
- You must have at least one assigned Microsoft 365 license to connect Microsoft 365 to Defender for Cloud Apps.
121
127
@@ -126,22 +132,21 @@ This section provides instructions for connecting Microsoft Defender for Cloud A
126
132
- You must [enable auditing in Power BI](/power-bi/admin/service-admin-auditing) to get the logs from there. Once auditing is enabled, Defender for Cloud Apps starts getting the logs (with a delay of 24-72 hours).
127
133
- You must [enable auditing in Dynamics 365](/power-platform/admin/enable-use-comprehensive-auditing#enable-auditing) to get the logs from there. Once auditing is enabled, Defender for Cloud Apps starts getting the logs (with a delay of 24-72 hours).
128
134
129
-
130
135
**To connect Microsoft 365 to Defender for Cloud Apps**:
131
136
132
137
1. In the Microsoft Defender Portal, select **Settings**. Then choose **Cloud Apps**. Under **Connected apps**, select **App Connectors**.
133
138
1. In the **App connectors** page, select **+Connect an app**, and then select **Microsoft 365**.
134
139
135
-
140
+
:::image type="content" source="media/connect-an-app.png" alt-text="Screenshot that shows the connect an app button." lightbox="media/connect-an-app.png":::
136
141
137
142
1. In the **Select Microsoft 365 components** page, select the options you require, and then select **Connect**.
138
143
139
144
> [!NOTE]
140
145
>
141
146
> - For best protection, we recommend selecting all Microsoft 365 components.
142
-
> - The **Azure AD files** component, requires the **Azure AD activities** component and Defender for Cloud Apps file monitoring (**Settings** > **Cloud Apps** > **Files** > **Enable file monitoring**).
:::image type="content" source="media/connect-office-365-components.png" alt-text="Screenshot showing the Connect Office 365 components page with the Microsoft 365 files box checked." lightbox="media/connect-office-365-components.png":::
145
150
146
151
1. On the **Follow the link** page, select **Connect Microsoft 365**.
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/release-notes.md
+63-4Lines changed: 63 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,14 +21,73 @@ For news about earlier releases, see [Archive of past updates for Microsoft Defe
21
21
22
22
## March 2025
23
23
24
-
### RBAC scoping for "Behaviors" (Preview)
24
+
### Role-Based Access Control scoping for "Behaviors" (Preview)
25
25
26
-
Defender for Cloud Apps customers can now configure Role-Based Access Control (RBAC) scoping for 'Behaviors'. This new capability empowers administrators to define and manage access permissions more precisely, ensuring that users have the appropriate level of access to specific application data based on their roles and responsibilities. By leveraging RBAC scoping, organizations can enhance their security posture, streamline operations, and reduce the risk of unauthorized access.
26
+
Defender for Cloud Apps customers can now configure Role-Based Access Control (RBAC) scoping for 'Behaviors.' This new capability allows administrators to define and manage access permissions more precisely. Administrators can ensure that users have the appropriate level of access to specific application data based on their roles and responsibilities. By using RBAC scoping, organizations can enhance their security posture, streamline operations, and reduce the risk of unauthorized access.
-[Investigate behaviors with advanced hunting (Preview)](/defender-cloud-apps/behaviors)
32
+
33
+
## February 2025
34
+
35
+
### Enhanced Visibility into OAuth Apps Connected to Microsoft 365 - General Availability
36
+
37
+
Defender for Cloud Apps users who use app governance are able to gain visibility into the origin of OAuth apps connected to Microsoft 365. You can filter and monitor apps that have external origins, to proactively review such apps and improve the security posture of the organization.
38
+
39
+
The new *Permissions filter and export capabilities allow you to quickly identify apps with specific permissions to access Microsoft 365.
40
+
41
+
You can now get granular insights into data accessed by apps using legacy EWS API alongside Microsoft Graph. The enhanced coverage of data usage insights enable you to get deeper visibility into apps accessing emails using legacy EWS API.
42
+
43
+
We're also expanding the coverage of privilege level feature for all popular Microsoft first-party API permissions. The enhanced coverage of privilege level classification enables you to view and monitor apps with powerful permissions into legacy and other non-Graph APIs that have access to Microsoft 365.
44
+
45
+
For more information, see [detailed insights into OAuth apps](/defender-cloud-apps/app-governance-visibility-insights-view-apps#getting-detailed-information-on-an-app).
46
+
47
+
### Enhanced alert source accuracy
48
+
49
+
Microsoft Defender for Cloud Apps is enhancing its alert sources to deliver more precise information. This update, applicable to new alerts only, are reflected across various experiences and APIs, including the Defender XDR portal, Advanced hunting, and Graph API.
50
+
Microsoft Defender for Cloud Apps is enhancing its alert sources to deliver more precise information. This update, applicable to new alerts only, are reflected across various experiences and APIs, including the Defender XDR portal, Advanced hunting, and Graph API.
51
+
The goal is to improve the accuracy of alert origins, facilitating better identification, management, and response to alerts.
52
+
53
+
To learn more about the different alert sources in Defender XDR see the _Alert sources_ section of [Investigate alerts in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn](/defender-xdr/investigate-alerts?tabs=settings)
54
+
55
+
56
+
### Network requirement updates
57
+
58
+
Microsoft Defender for Cloud Apps has improved its security and performance. Network information in firewalls and additional third-party services must be updated to comply with the new standards. To ensure uninterrupted access to our services you must apply these changes by March 16, 2025.
59
+
Microsoft Defender for Cloud Apps has improved its security and performance. Network information in firewalls and additional third-party services must be updated to comply with the new standards. To ensure uninterrupted access to our services you must apply these changes by March 27, 2025.
60
+
61
+
To connect to third-party apps and enable Defender for Cloud Apps, use the following IP addresses:
To stay up to date on IP ranges, it's recommended to refer to the following Azure service tags for Microsoft Defender for Cloud Apps services. The latest IP ranges are found in the service tag. For more information, see [Azure IP ranges](/azure/virtual-network/service-tags-overview).
Copy file name to clipboardExpand all lines: defender-endpoint/configure-device-connectivity.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,7 @@ ms.collection:
14
14
ms.reviewer: pahuijbr
15
15
search.appverid: MET150
16
16
audience: ITPro
17
-
ms.date: 02/04/2025
17
+
ms.date: 03/12/2025
18
18
---
19
19
20
20
# Onboarding devices using streamlined connectivity for Microsoft Defender for Endpoint
@@ -170,11 +170,11 @@ The following preonboarding checks can be run on both Windows and Xplat MDE Clie
170
170
171
171
To test streamlined connectivity for devices not yet onboarded to Defender for Endpoint, you can use the Client Analyzer for Windows using the following commands:
172
172
173
-
- Run `mdeclientanalyzer.cmd -o <path to cmd file>` from within MDEClientAnalyzer folder. The command uses parameters from onboarding package to test connectivity.
173
+
- Run `mdeclientanalyzer.cmd -o <path to cmd file>` from within the MDEClientAnalyzer folder. The command uses parameters from onboarding package to test connectivity.
174
174
175
175
- Run `mdeclientanalyzer.cmd -g <GW_US, GW_UK, GW_EU>` , where parameter is of GW_US, GW_EU, GW_UK. GW refers to the streamlined option. Run with applicable tenant geo.
176
176
177
-
As a supplementary check, you can also use the client analyzer to test whether a device meets prerequisites: https://aka.ms/MDEClientAnalyzerPreview
177
+
As a supplementary check, you can also use the client analyzer to test whether a device meets prerequisites: [MDEClientAnalyzerPreview.zip]{https://aka.ms/MDEClientAnalyzerPreview}.
0 commit comments