You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: ATPDocs/role-groups.md
+6-1Lines changed: 6 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,6 +15,9 @@ Users that are already [Global Administrators](/entra/identity/role-based-access
15
15
16
16
For other users, enable and use Microsoft 365 role-based access control (RBAC) to create custom roles and to support more Entra ID roles such as Security operator or Security Reader by default to manage access to Defender for Identity.
17
17
18
+
> [!IMPORTANT]
19
+
>Starting March 2, 2025, new Microsoft Defender for Identity tenants can only configure permissions through Microsoft Defender XDR [Unified Role-Based Access Control (RBAC)](/defender-xdr/manage-rbac). Tenants with roles assigned or exported before this date will retain their current configuration.
20
+
18
21
When creating your custom roles, make sure that you apply the permissions listed in the following table:
19
22
20
23
|Defender for Identity access level | Minimum required Microsoft 365 unified RBAC permissions |
@@ -47,9 +50,11 @@ The following table details the specific permissions required for Defender for I
47
50
|**View the Assets / Identities page**|[Permissions](/defender-cloud-apps/manage-admins) to access Defender for Cloud Apps <br> **Or** <br> One of the Microsoft Entra roles required by [Microsoft Defender XDR](/microsoft-365/security/defender/m365d-permissions)|
48
51
|**Perform Defender for Identity response actions**|A [custom role](/microsoft-365/security/defender/create-custom-rbac-roles) defined with permissions for **Response (manage)**<br> **Or** <br> One of the following Microsoft Entra roles:<br>- [Security Operator](/entra/identity/role-based-access-control/permissions-reference)|
49
52
50
-
51
53
## Defender for Identity security groups
52
54
55
+
> [!IMPORTANT]
56
+
> Starting March 2, Defender for Identity will no longer create Microsoft Entra ID security groups. Tenants can still configure the same permissions through Microsoft Defender XDR [Unified Role-Based Access Control (RBAC)](/defender-xdr/manage-rbac)
57
+
53
58
Defender for Identity provides the following security groups to help manage access to Defender for Identity resources:
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/release-notes.md
-63Lines changed: 0 additions & 63 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,69 +19,6 @@ For more information on what's new with other Microsoft Defender security produc
19
19
20
20
For news about earlier releases, see [Archive of past updates for Microsoft Defender for Cloud Apps](release-note-archive.md).
21
21
22
-
## February 2025
23
-
24
-
### Enhanced Visibility into OAuth Apps Connected to Microsoft 365 - General Availability
25
-
26
-
Defender for Cloud Apps users who use app governance will be able to gain visibility into the origin of OAuth apps connected to Microsoft 365. You can filter and monitor apps that have external origins, to proactively review such apps and improve the security posture of the organization.
27
-
28
-
The new *Permissions filter and export capabilities allow you to quickly identify apps with specific permissions to access Microsoft 365.
29
-
30
-
You can now get granular insights into data accessed by apps using legacy EWS API alongside Microsoft Graph. The enhanced coverage of data usage insights enable you to get deeper visibility into apps accessing emails using legacy EWS API.
31
-
32
-
We're also expanding the coverage of privilege level feature for all popular Microsoft first-party API permissions. The enhanced coverage of privilege level classification enables you to view and monitor apps with powerful permissions into legacy and other non-Graph APIs that have access to Microsoft 365.
33
-
34
-
For more information, see [detailed insights into OAuth apps](/defender-cloud-apps/app-governance-visibility-insights-view-apps#getting-detailed-information-on-an-app).
35
-
36
-
### Enhanced alert source accuracy
37
-
38
-
Microsoft Defender for Cloud Apps is enhancing its alert sources to deliver more precise information. This update, applicable to new alerts only, will be reflected across various experiences and APIs, including the Defender XDR portal, Advanced hunting, and Graph API.
39
-
The goal is to improve the accuracy of alert origins, facilitating better identification, management, and response to alerts.
40
-
41
-
To learn more about the different alert sources in Defender XDR see the _Alert sources_ section of [Investigate alerts in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn](/defender-xdr/investigate-alerts?tabs=settings)
42
-
43
-
To learn more about the Graph API alert resource: [alert resource type - Microsoft Graph v1.0 | Microsoft Learn](/graph/api/resources/security-alert?view=graph-rest-1.0&preserve-view=true)
44
-
45
-
### Network requirement updates
46
-
47
-
Microsoft Defender for Cloud Apps has improved its security and performance. Network information in firewalls and additional third-party services must be updated to comply with the new standards. To ensure uninterrupted access to our portals and services you must apply these changes by March 27, 2025.
48
-
49
-
New CDN domains have been added and must be included in firewall rules to allow outbound traffic on port 443:
50
-
- cdn.cloudappsecurity.com
51
-
- cdn-discovery.cloudappsecurity.com
52
-
53
-
To connect to third-party apps and enable Defender for Cloud Apps, use the following IP addresses:
To stay up to date on IP ranges, it's recommended to refer to the following Azure service tags for Microsoft Defender for Cloud Apps services. The latest IP ranges are found in the service tag. For more information, see [Azure IP ranges](/azure/virtual-network/service-tags-overview).
Copy file name to clipboardExpand all lines: defender-office-365/attack-simulation-training-payloads.md
+7-2Lines changed: 7 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ ms.collection:
13
13
ms.custom:
14
14
description: Admins can learn how to create and manage payloads for Attack simulation training in Microsoft Defender for Office 365 Plan 2.
15
15
search.appverid: met150
16
-
ms.date: 08/13/2024
16
+
ms.date: 03/10/2025
17
17
appliesto:
18
18
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 2</a>
19
19
---
@@ -147,7 +147,12 @@ You can also create custom payloads that use QR codes as phishing links as descr
147
147
## Create payloads
148
148
149
149
> [!NOTE]
150
-
> Certain trademarks, logos, symbols, insignias and other source identifiers receive heightened protection under local, state and federal statutes and laws. Unauthorized use of such indicators can subject the users to penalties, including criminal fines. Though not an extensive list, this includes the Presidential, Vice Presidential, and Congressional seals, the CIA, the FBI, Social Security, Medicare and Medicaid, the United States Internal Revenue Service, and the Olympics. Beyond these categories of trademarks, use and modification of any third-party trademark carries an inherent amount of risk. Using your own trademarks and logos in a payload would be less risky, particularly where your organization permits the use. If you have any further questions about what is or is not appropriate to use when creating or configuring a payload, you should consult with your legal advisors.
150
+
>
151
+
> - Certain trademarks, logos, symbols, insignias and other source identifiers receive heightened protection under local, state and federal statutes and laws. Unauthorized use of such indicators can subject the users to penalties, including criminal fines. Though not an extensive list, this includes the Presidential, Vice Presidential, and Congressional seals, the CIA, the FBI, Social Security, Medicare and Medicaid, the United States Internal Revenue Service, and the Olympics. Beyond these categories of trademarks, use and modification of any third-party trademark carries an inherent amount of risk. Using your own trademarks and logos in a payload would be less risky, particularly where your organization permits the use. If you have legal questions around logo and brand usage, consult with your legal advisors.
152
+
>
153
+
> - Microsoft permits customers to use our logos and branding in their custom payloads within Attack simulation training, as long as the logo and branding are used only as part of simulation content. The user landing page should contain a highly visible, unavoidable disclaimer that clearly states Microsoft isn't associated with and doesn't endorse the simulation exercise, nor was it an actual email from or associated with Microsoft. You can use the text from Microsoft's global landing page as a reference:
154
+
>
155
+
> _The message you just clicked on is a phishing message simulation. It is not a real message from the owner of the trademark or logo featured in the simulation. The trademarks and logos featured in the simulation may be the property of their respective owners and are in no way associated or affiliated with the simulation, nor have the owners of such trademarks and logos authorized, sponsored, or endorsed the use of such trademarks and logos in the simulation._
151
156
152
157
1. In the Microsoft Defender portal at <https://security.microsoft.com>, go to **Email & collaboration**\>**Attack simulation training**\>**Content library** tab \>**Payloads**\>**Tenant payloads** tab. To go directly to the **Content library** tab where you can select **Payloads** and the **Tenant payloads** tab, use <https://security.microsoft.com/attacksimulator?viewid=contentlibrary>.
0 commit comments