Skip to content

Commit 58aeb5e

Browse files
chrisdachrisda
committed
Merge branch 'main' into MDOPriv-chrisda
2 parents 3ac0c0c + 2913884 commit 58aeb5e

File tree

347 files changed

+1590
-926
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

347 files changed

+1590
-926
lines changed

‎.github/workflows/AutoLabelAssign.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Assign and label PR
2+
3+
permissions:
4+
pull-requests: write
5+
contents: read
6+
actions: read
7+
8+
on:
9+
workflow_run:
10+
workflows: [Background tasks]
11+
types:
12+
- completed
13+
14+
jobs:
15+
download-payload:
16+
name: Download and extract payload artifact
17+
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-ExtractPayload.yml@workflows-prod
18+
with:
19+
WorkflowId: ${{ github.event.workflow_run.id }}
20+
OrgRepo: ${{ github.repository }}
21+
secrets:
22+
AccessToken: ${{ secrets.GITHUB_TOKEN }}
23+
24+
label-assign:
25+
name: Run assign and label
26+
needs: [download-payload]
27+
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-AutoLabelAssign.yml@workflows-prod
28+
with:
29+
PayloadJson: ${{ needs.download-payload.outputs.WorkflowPayload }}
30+
AutoAssignUsers: 1
31+
AutoLabel: 1
32+
ExcludedUserList: '["user1", "user2"]'
33+
ExcludedBranchList: '["branch1", "branch2"]'
34+
secrets:
35+
AccessToken: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/AutoLabelMsftContributor.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: Auto label Microsoft contributors
2+
3+
permissions:
4+
pull-requests: write
5+
contents: read
6+
actions: read
7+
8+
on:
9+
workflow_run:
10+
workflows: [Background tasks]
11+
types:
12+
- completed
13+
14+
jobs:
15+
download-payload:
16+
if: github.repository_visibility == 'public'
17+
name: Download and extract payload artifact
18+
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-ExtractPayload.yml@workflows-prod
19+
with:
20+
WorkflowId: ${{ github.event.workflow_run.id }}
21+
OrgRepo: ${{ github.repository }}
22+
secrets:
23+
AccessToken: ${{ secrets.GITHUB_TOKEN }}
24+
25+
label-msft:
26+
name: Label Microsoft contributors
27+
if: github.repository_visibility == 'public'
28+
needs: [download-payload]
29+
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-AutoLabelMsftContributor.yml@workflows-prod
30+
with:
31+
PayloadJson: ${{ needs.download-payload.outputs.WorkflowPayload }}
32+
secrets:
33+
AccessToken: ${{ secrets.GITHUB_TOKEN }}
34+
TeamReadAccessToken: ${{ secrets.ORG_READTEAMS_TOKEN }}

‎.github/workflows/BackgroundTasks.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Background tasks
2+
3+
permissions:
4+
pull-requests: write
5+
contents: read
6+
7+
on:
8+
pull_request_target:
9+
10+
jobs:
11+
upload:
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Save payload data
16+
env:
17+
PayloadJson: ${{ toJSON(github) }}
18+
AccessToken: ${{ github.token }}
19+
run: |
20+
mkdir -p ./pr
21+
echo $PayloadJson > ./pr/PayloadJson.json
22+
sed -i -e "s/$AccessToken/XYZ/g" ./pr/PayloadJson.json
23+
- uses: actions/upload-artifact@v4
24+
with:
25+
name: PayloadJson
26+
path: pr/

‎.github/workflows/LiveMergeCheck.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: PR can merge into branch
2+
3+
permissions:
4+
pull-requests: write
5+
statuses: write
6+
contents: read
7+
8+
on:
9+
pull_request_target:
10+
types: [opened, reopened, synchronize, edited]
11+
12+
jobs:
13+
14+
live-merge:
15+
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-LiveMergeCheck.yml@workflows-prod
16+
with:
17+
PayloadJson: ${{ toJSON(github) }}
18+
secrets:
19+
AccessToken: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/PrFileCount.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: PR file count less than limit
2+
3+
permissions:
4+
pull-requests: write
5+
statuses: write
6+
contents: read
7+
8+
on:
9+
pull_request_target:
10+
types: [opened, reopened, synchronize, labeled, unlabeled, edited]
11+
12+
jobs:
13+
14+
file-count:
15+
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-PrFileCount.yml@workflows-prod
16+
with:
17+
PayloadJson: ${{ toJSON(github) }}
18+
secrets:
19+
AccessToken: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/ProtectedFiles.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: PR has no protected files
2+
3+
permissions:
4+
pull-requests: write
5+
statuses: write
6+
contents: read
7+
8+
on: [pull_request_target]
9+
10+
jobs:
11+
12+
protected-files:
13+
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-ProtectedFiles.yml@workflows-prod
14+
with:
15+
PayloadJson: ${{ toJSON(github) }}
16+
secrets:
17+
AccessToken: ${{ secrets.GITHUB_TOKEN }}

‎defender-endpoint/android-configure-mam.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ ms.collection:
1414
- mde-android
1515
ms.topic: conceptual
1616
ms.subservice: android
17-
ms.date: 07/25/2024
17+
ms.date: 08/08/2024
1818
---
1919

2020
# Configure Microsoft Defender for Endpoint on Android risk signals using App Protection Policies (MAM)
@@ -124,14 +124,14 @@ End users also need to take steps to install Microsoft Defender for Endpoint on
124124

125125
1. Sign in to a managed application, for example, Outlook. The device is registered and the application protection policy is synchronized to the device. The application protection policy recognizes the device's health state.
126126

127-
2. Select **Continue**. A screen is presented which recommends downloading and setting up of Microsoft Defender for Endpoint on Android app.
127+
2. Select **Continue**. A screen is presented which recommends downloading and setting up of the Microsoft Defender: Antivirus (Mobile) app.
128128

129129
3. Select **Download**. You'll be redirected to the app store (Google play).
130130

131-
4. Install the Microsoft Defender for Endpoint (Mobile) app and launch back Managed app onboarding screen.
132-
133-
:::image type="content" source="media/download-mde.png" alt-text="The illustrative pages that contain the procedure of downloading MDE and launching back the app-onboarding screen." lightbox="media/download-mde.png":::
131+
4. Install the Microsoft Defender: Antivirus (Mobile) app and go back to the managed app onboarding screen.
134132

133+
:::image type="content" source="media/mam-flow.png" alt-text="Shows the procedure of downloading Microsoft Defender: Antivirus (Mobile) app." lightbox="media/mam-flow.png":::
134+
135135
5. Click **Continue > Launch**. The Microsoft Defender for Endpoint app onboarding/activation flow is initiated. Follow the steps to complete onboarding. You'll automatically be redirected back to Managed app onboarding screen, which now indicates that the device is healthy.
136136

137137
6. Select **Continue** to log into the managed application.

‎defender-endpoint/android-configure.md‎

Lines changed: 14 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -61,36 +61,32 @@ Network protection in Microsoft Defender for endpoint is disabled by default. Ad
6161

6262
1. In the Microsoft Intune admin center, navigate to Apps > App configuration policies. Create a new App configuration policy.
6363

64-
> [!div class="mx-imgBorder"]
65-
> ![Image of how to create a policy.](media/android-mem.png)
66-
64+
> [!div class="mx-imgBorder"]
6765
1. Provide a name and description to uniquely identify the policy. Select **'Android Enterprise'** as the platform and **'Personally-owned work profile only'** as the profile type and **'Microsoft Defender'** as the Targeted app.
6866

69-
> [!div class="mx-imgBorder"]
70-
> ![Image of policy details.](media/appconfigdetails.png)
71-
67+
> [!div class="mx-imgBorder"]
68+
> ![Screenshot of policy details.](media/appconfigdetails.png)
69+
7270
1. In Settings page, select **'Use configuration designer'** and add **'Enable Network Protection in Microsoft Defender'** as the key and value as **'1'** to enable Network Protection. (Network protection is disabled by default)
7371

74-
> [!div class="mx-imgBorder"]
75-
> ![Image of how to select enable network protection policy](media/selectnp.png)
76-
77-
> [!div class="mx-imgBorder"]
78-
> ![Image of add configuration policy.](media/npvalue.png)
79-
72+
> [!div class="mx-imgBorder"]
73+
> ![Screenshot of how to select enable network protection policy](media/selectnp.png)
74+
75+
> [!div class="mx-imgBorder"]
76+
> ![Screenshot of add configuration policy.](media/npvalue.png)
77+
8078
1. If your organization uses root CAs that are private, you must establish explicit trust between Intune (MDM solution) and user devices. Establishing trust helps prevent Defender from flagging root CAs as rogue certificates.
8179

8280
To establish trust for the root CAs, use **'Trusted CA certificate list for Network Protection'** as the key. In the value, add the **'comma separated list of certificate thumbprints (SHA 1)'**.
8381

8482
**Example of Thumbprint format to add**: `50 30 06 09 1d 97 d4 f5 ae 39 f7 cb e7 92 7d 7d 65 2d 34 31, 503006091d97d4f5ae39f7cbe7927d7d652d3431`
8583

86-
> [!IMPORTANT]
84+
> [!IMPORTANT]
8785
> Certificate SHA-1 Thumbprint characters should be with either white space separated, or non separated.
8886
>
8987
> This format is invalid: `50:30:06:09:1d:97:d4:f5:ae:39:f7:cb:e7:92:7d:7d:65:2d:34:31`
9088
91-
Any other separation characters are invalid.
92-
93-
> ![Image of trusted CA certificate.](media/trustca.png)
89+
Any other separation characters are invalid.
9490

9591
1. For other configurations related to Network protection, add the following keys and appropriate corresponding value.
9692

@@ -119,26 +115,6 @@ Network protection in Microsoft Defender for endpoint is disabled by default. Ad
119115

120116
> [!NOTE]
121117
> Users need to enable location permission (which is an optional permission); this enables Defender for Endpoint to scan their networks and alert them when there are WIFI-related threats. If the location permission is denied by the user, Defender for Endpoint will only be able to provide limited protection against network threats and will only protect the users from rogue certificates.
122-
123-
## Configure Low Touch Onboarding
124-
125-
Admins can configure Microsoft Defender for Endpoint in low touch onboarding mode. In this scenario, administrators creates a deployment profile and the user is simply required to provide a reduced set of permissions to complete onboarding.
126-
127-
Android low touch onboarding is disabled by default. Admins can enable it through app configuration policies on Intune by following these steps:
128-
129-
1. Push the Defender app to target user group by following these [steps](android-intune.md#add-microsoft-defender-for-endpoint-on-android-as-a-managed-google-play-app).
130-
2. Push a VPN profile to the user's device by following the instructions [here](android-intune.md#auto-setup-of-always-on-vpn).
131-
3. In Apps > Application configuration policies, select Managed Devices.
132-
4. Provide a name to uniquely identify the policy. Select 'Android Enterprise' as the Platform, the required Profile type and 'Microsoft Defender: Antivirus' as the targeted app. Click on Next.
133-
5. Add runtime permissions. Select Location access (fine)(This permission is not supported for Android 13 and above), POST_NOTIFICATIONS and change the Permission state to 'Auto grant'.
134-
6. Under configuration settings, select 'Use Configuration designer' and click on Add.
135-
7. Select Low touch onboarding and User UPN. For User UPN, change the Value type to 'Variable' and Configuration value to 'User Principal Name' from the drop down Enable Low touch onboarding by changing the configuration value to 1.
136-
>[!div class="mx-imgBorder"]
137-
>![Image of low touch onboarding configuration policy.](media/low-touch-user-upn.png)
138-
139-
8. Assign the policy to the target user group.
140-
9. Review and create the policy.
141-
142118
## Privacy Controls
143119

144120
Following privacy controls are available for configuring the data that is sent by Defender for Endpoint from Android devices:
@@ -347,11 +323,11 @@ Use the following steps to configure the Device tags:
347323
5. Click Next and assign this policy to targeted devices and users.
348324

349325

350-
> [!NOTE]
326+
> [!NOTE]
351327
> The Defender app needs to be opened for tags to be synced with Intune and passed to Security Portal. It may take up to 18 hours for tags to reflect in the portal.
352-
353328
## Related articles
354329

355330
- [Overview of Microsoft Defender for Endpoint on Android](microsoft-defender-endpoint-android.md)
331+
356332
- [Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune](android-intune.md)
357333
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]

‎defender-endpoint/api/get-all-recommendations.md‎

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -100,34 +100,36 @@ Here is an example of the response.
100100
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Recommendations",
101101
"value": [
102102
{
103-
"id": "va-_-microsoft-_-windows_10" "va-_-microsoft-_-windows_11",
104-
"productName": "windows_10" "Windows_11",
105-
"recommendationName": "Update Windows 10" "Update Windows 11",
106-
"weaknesses": 397,
103+
"id": "va-_-microsoft-_-edge_chromium-based",
104+
"productName": "edge_chromium-based",
105+
"recommendationName": "Update Microsoft Edge Chromium-based to version 127.0.2651.74",
106+
"weaknesses": 762,
107107
"vendor": "microsoft",
108-
"recommendedVersion": "",
108+
"recommendedVersion": "127.0.2651.74",
109+
"recommendedVendor": "",
110+
"recommendedProgram": "",
109111
"recommendationCategory": "Application",
110112
"subCategory": "",
111113
"severityScore": 0,
112114
"publicExploit": true,
113115
"activeAlert": false,
114116
"associatedThreats": [
115-
"3098b8ef-23b1-46b3-aed4-499e1928f9ed",
116-
"40c189d5-0330-4654-a816-e48c2b7f9c4b",
117-
"4b0c9702-9b6c-4ca2-9d02-1556869f56f8",
118-
"e8fc2121-3cf3-4dd2-9ea0-87d7e1d2b29d",
119-
"94b6e94b-0c1d-4817-ac06-c3b8639be3ab"
117+
"71d9120e-7eea-4058-889a-1a60bbf7e312"
120118
],
121119
"remediationType": "Update",
122120
"status": "Active",
123121
"configScoreImpact": 0,
124-
"exposureImpact": 7.674418604651163,
125-
"totalMachineCount": 37,
126-
"exposedMachinesCount": 7,
122+
"exposureImpact": 1.1744086343876479,
123+
"totalMachineCount": 261,
124+
"exposedMachinesCount": 193,
127125
"nonProductivityImpactedAssets": 0,
128-
"relatedComponent": "Windows 10" "Windows 11"
126+
"relatedComponent": "Edge Chromium-based",
127+
"hasUnpatchableCve": false,
128+
"tags": [
129+
"internetFacing"
130+
],
131+
"exposedCriticalDevices": 116
129132
}
130-
...
131133
]
132134
}
133135
```

‎defender-endpoint/api/get-all-vulnerabilities.md‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -94,21 +94,24 @@ Here is an example of the response.
9494
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Vulnerabilities",
9595
"value": [
9696
{
97-
"id": "CVE-2019-0608",
98-
"name": "CVE-2019-0608",
99-
"description": "A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services.To exploit the vulnerability, the user must click a specially crafted URL. In an email attack scenario, an attacker could send an email message containing the specially crafted URL to the user in an attempt to convince the user to click it.In a web-based attack scenario, an attacker could host a specially crafted website designed to appear as a legitimate website to the user. However, the attacker would have no way to force the user to visit the specially crafted website. The attacker would have to convince the user to visit the specially crafted website, typically by way of enticement in an email or instant message, and then convince the user to interact with content on the website.The update addresses the vulnerability by correcting how Microsoft Browsers parses HTTP responses.",
100-
"severity": "Medium",
101-
"cvssV3": 4.3,
97+
"id": "CVE-2024-7256",
98+
"name": "CVE-2024-7256",
99+
"description": "Summary: Google Chrome is vulnerable to a security bypass due to insufficient data validation in Dawn. An attacker can exploit this vulnerability by tricking a user into visiting a malicious website, allowing them to bypass security restrictions. Impact: If successfully exploited, this vulnerability could allow a remote attacker to bypass security restrictions in Google Chrome. Remediation: Apply the latest patches and updates provided by the respective vendors. Generated by AI",
100+
"severity": "High",
101+
"cvssV3": 8,
102102
"cvssVector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
103-
"exposedMachines": 4,
104-
"publishedOn": "2019-10-08T00:00:00Z",
105-
"updatedOn": "2019-12-16T16:20:00Z",
103+
"exposedMachines": 23,
104+
"publishedOn": "2024-07-30T00:00:00Z",
105+
"updatedOn": "2024-07-31T00:00:00Z",
106+
"firstDetected": "2024-07-31T01:55:47Z",
106107
"publicExploit": false,
107108
"exploitVerified": false,
108109
"exploitInKit": false,
109110
"exploitTypes": [],
110111
"exploitUris": [],
111-
"CveSupportability": "supported"
112+
"cveSupportability": "Supported",
113+
"tags": [],
114+
"epss": 0.632
112115
}
113116
]
114117

0 commit comments

Comments
 (0)