Merge branch 'main' into urbac-mto-ga

Author: batamig

.openpublishing.publish.config.json

@@ -191,6 +191,8 @@
     ".openpublishing.redirection.defender-cloud-apps.json",
     ".openpublishing.redirection.defender-endpoint.json",
     ".openpublishing.redirection.defender-office-365.json",
-    ".openpublishing.redirection.defender-xdr.json"
+    ".openpublishing.redirection.defender-xdr.json",
+    ".openpublishing.redirection.unified-secops.json"
+
   ]
 }

.openpublishing.redirection.unified-secops.json

@@ -0,0 +1,9 @@
+{
+  "redirections": [
+    {
+      "source_path": "unified-secops-platform/mto-tenantgroups.md",
+      "redirect_url": "mto-distribution-profiles",
+      "redirect_document_id": false
+    }
+  ]
+}

defender-endpoint/microsoft-defender-antivirus-updates.md

@@ -99,6 +99,30 @@ Updates contain:
 - Serviceability improvements
 - Integration improvements (Cloud, [Microsoft Defender XDR](/defender-xdr/microsoft-365-defender))
 
+
+### July-2025 (Platform: 4.18.25070.5 | Engine: 1.1.25070.4)
+
+- Security intelligence update version: **1.435.11.0**
+- Release date:  **August 5, 2025 (Engine) / August 6, 2025 (Platform)**
+- Platform: **4.18.25070.5**
+- Engine: **1.1.25070.4**
+- Support phase: **Security and Critical Updates**
+
+#### What's new
+
+- Enhanced Passive Mode Scanning Behavior
+When Microsoft Defender is in Passive mode, an Antivirus scan will not occur after a signature update , unless specifically set in the policy setting DisableScanOnUpdate.
+
+- Improved Tamper Protection Handling
+Optimized the configuration process for Tamper Protection in multi-threaded environments to ensure more reliable behavior.
+
+- Digital Signature Verification Performance Boost
+Enhanced the efficiency of digital signature verification to improve overall system performance.
+
+- Refined ASR Rule Exclusion Processing
+Refined exclusion processing and resolved false positives for the Attack Surface Reduction (ASR) rule: Block Office applications from injecting code into other processes.
+
+
 ### June-2025 (Platform: 4.18.25060.7 | Engine: 1.1.25060.6)
 
 - Security intelligence update version: **1.433.2.0**

defender-office-365/air-view-investigation-results.md

@@ -349,7 +349,7 @@ On the investigation details page, the **Entities** tab shows details about the
 
 The **Entities** tab is organized by a view selection pane (a summary view and a view for each entity type) and a corresponding details table for that view:
 
-- **Evidence summary** view: This is the default view.
+- **Evidence summary** view: This view is the default.
 
   You can sort the entries in the details table by clicking on an available column header. Select :::image type="icon" source="media/m365-cc-sc-customize-icon.png" border="false"::: **Customize columns** to change the columns that are shown. By default, all available columns are selected:
 

defender-office-365/anti-phishing-policies-mdo-configure.md

@@ -112,7 +112,7 @@ For anti-phishing policy procedures in organizations without Defender for Office
 5. On the **Phishing threshold & protection** page, configure the following settings:
 
    - **Phishing email threshold**: Use the slider to select one of the following values:
-     - **1 - Standard** (This is the default value.)
+     - **1 - Standard** (This value is the default.)
      - **2 - Aggressive**
      - **3 - More aggressive**
      - **4 - Most aggressive**

defender-office-365/anti-spam-policies-asf-settings-about.md

@@ -52,7 +52,7 @@ For each ASF setting, the following options are available in anti-spam policies:
 - **On**: ASF adds the corresponding X-header field to the message:
   - For [Increase spam score settings](#increase-spam-score-settings), the message has a higher chance of being marked as**Spam**.
   - For [Mark as spam settings](#mark-as-spam-settings), the message is marked as **Spam** or **High confidence spam**.
-- **Off**: The ASF setting is disabled. This is the default value.
+- **Off**: The ASF setting is disabled. This value is the default.
 - **Test**: The ASF setting is in Test Mode. What happens to the message is determined by the **Test mode** (_TestModeAction_) value:
   - **None**: Message delivery is unaffected by the ASF detection. The message is still subject to other types of filtering and rules.
   - **Add default X-header text** (_AddXHeader_): The X-header value `X-CustomSpam: This message was filtered by the custom spam filter option` is added to the message. You can use this value in Inbox rules (not mail flow rules) to affect the delivery of the message.

defender-office-365/attack-simulation-training-end-user-notifications.md

@@ -111,7 +111,7 @@ On the details flyout from the **Tenant notifications** tab only, select **Edit
    - **From display name**: Enter the display name of the sender.
    - **From email address**: Enter the email address of the sender.
    - **Select the language of the email**: Select one of the following languages: **Chinese (Simplified)**, **Chinese (Traditional, Taiwan)**, **English**, **French**, **German**, **Italian**, **Japanese**, **Korean**, **Portuguese**, **Russian**, **Spanish**, **Dutch**, **Polish**, **Arabic**, **Finnish**, **Greek**, **Hungarian**, **Indonesian**, **Norwegian Bokmål**, **Romanian**, **Slovak**, **Swedish**, **Thai**, **Turkish**, **Vietnamese**, **Catalan**, **Croatian**, or **Slovenian**.
-   - **Mark this as the default language**: Because this is the first and only language for the notification, this language value is selected as the default, and you can't change it.
+   - **Mark this as the default language**: Because this language is the first and only language for the notification, this language value is selected as the default, and you can't change it.
    - **Subject**: The default that's used depends on the notification type that you selected in the previous step, but you can change it:
      - Positive reinforcement: **Thank you for reporting a phish!**
      - Simulation: **Thank you for participating in a phishing campaign!**

defender-office-365/attack-simulation-training-simulation-automations.md

@@ -276,12 +276,12 @@ Use the following options on the page to assign trainings as part of the simulat
 
 - **Preferences** section: In **Select training content preference**, choose one of the following options in the dropdown list:
 
-  - **Microsoft training experience (Recommended)**: This is the default value. This value has the following associated options to configure on the page:
+  - **Microsoft training experience (Recommended)**: This value is the default. This value has the following associated options to configure on the page:
     - Select one of the following values:
-      - **Assign training for me (Recommended)**: This is the default value. We assign training based on a user's previous simulation and training results.
+      - **Assign training for me (Recommended)**: This value is the default. We assign training based on a user's previous simulation and training results.
       - **Select training courses and modules myself**: If you select this value, the next step in the wizard is **Training assignment** where you find and select trainings. The steps are described in the [Training assignment](#training-assignment) subsection.
     - **Due date** section: In **Select a training due date**, choose one of the following values:
-      - **30 days after simulation ends** (this is the default value)
+      - **30 days after simulation ends** (this value is the default)
       - **15 days after simulation ends**
       - **7 days after simulation ends**
 
@@ -291,7 +291,7 @@ Use the following options on the page to assign trainings as part of the simulat
     - **Custom training description**
     - **Custom training duration (in minutes)**: The default value is 0, which means there's no specified duration for the training.
     - **Due date** section: In **Select a training due date**, choose one of the following values:
-      - **30 days after simulation ends** (this is the default value)
+      - **30 days after simulation ends** (this value is the default)
       - **15 days after simulation ends**
       - **7 days after simulation ends**
 

defender-office-365/attack-simulation-training-simulations.md

@@ -303,12 +303,12 @@ Use the following options on the page to assign trainings as part of the simulat
 
 - **Preferences** section: In **Select training content preference**, choose one of the following options in the dropdown list:
 
-  - **Microsoft training experience (Recommended)**: This is the default value. This value has the following associated options to configure on the page:
+  - **Microsoft training experience (Recommended)**: This value is the default. This value has the following associated options to configure on the page:
     - Select one of the following values:
-      - **Assign training for me (Recommended)**: This is the default value. We assign training based on a user's previous simulation and training results.
+      - **Assign training for me (Recommended)**: This value is the default. We assign training based on a user's previous simulation and training results.
       - **Select training courses and modules myself**: If you select this value, the next step in the wizard is **Training assignment** where you find and select trainings. The steps are described in the [Training assignment](#training-assignment) subsection.
     - **Due date** section: In **Select a training due date**, choose one of the following values:
-      - **30 days after simulation ends** (this is the default value)
+      - **30 days after simulation ends** (this value is the default)
       - **15 days after simulation ends**
       - **7 days after simulation ends**
 
@@ -318,7 +318,7 @@ Use the following options on the page to assign trainings as part of the simulat
     - **Custom training description**
     - **Custom training duration (in minutes)**: The default value is 0, which means there's no specified duration for the training.
     - **Due date** section: In **Select a training due date**, choose one of the following values:
-      - **30 days after simulation ends** (this is the default value)
+      - **30 days after simulation ends** (this value is the default)
       - **15 days after simulation ends**
       - **7 days after simulation ends**
 
@@ -427,7 +427,7 @@ On the **Select end user notification** page, select from the following notifica
 - **Do not deliver notifications**: No other configuration options are available on the page. Users don't receive **Training assignment notifications**, **Training reminder notifications** or **Positive reinforcement notifications** from the simulation. Select **Proceed** in the warning dialog.
 
 - **Microsoft default notification (recommended)**: The notifications that users receive are shown on the page:
-  - **Microsoft default positive reinforcement notification** (for the **How-to Guide** [social engineering technique](#select-a-social-engineering-technique), this is the only available notification)
+  - **Microsoft default positive reinforcement notification** (for the **How-to Guide** [social engineering technique](#select-a-social-engineering-technique), this notification is the only available notification)
   - **Microsoft default training assignment notification**
   - **Microsoft default training reminder notification**
 

defender-office-365/campaigns.md

@@ -329,7 +329,7 @@ The tabs in the campaign details flyout allow you to further investigate the cam
   - **SPF passed**: The sender was authenticated by the [Sender Policy Framework (SPF)](email-authentication-spf-configure.md). A sender that doesn't pass SPF validation indicates an unauthenticated sender, or the message is spoofing a legitimate sender.
 
 - **Senders**
-  - **Sender**: This is the actual sender address in the SMTP **MAIL FROM** command, which isn't necessarily the **From:** email address that users see in their email clients.
+  - **Sender**: This address is the actual sender address in the SMTP **MAIL FROM** command, which isn't necessarily the **From:** email address that users see in their email clients.
   - **Total count**
   - **Inboxed**
   - **Not Inboxed**