You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/activity-filters-queries.md
+48-11Lines changed: 48 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ This article provides descriptions and instructions for Defender for Cloud Apps
13
13
14
14
## Activity filters
15
15
16
-
Below is a list of the activity filters that can be applied. Most filters support multiple values as well as*NOT* to provide you with a powerful tool for policy creation.
16
+
Below is a list of the activity filters that can be applied. Most filters support multiple values and*NOT* to provide you with a powerful tool for policy creation.
17
17
18
18
- Activity ID - Search only for specific activities by their ID. This filter is useful when you connect Microsoft Defender for Cloud Apps to your SIEM (using the SIEM agent) and you want to further investigate alerts using Defender for Cloud Apps.
19
19
@@ -30,7 +30,7 @@ Below is a list of the activity filters that can be applied. Most filters suppor
30
30
- Activity type - Search for the app activity.
31
31
32
32
> [!NOTE]
33
-
> Apps are added to the filter only if there is activity for that app.
33
+
> Apps are added to the filter only if there's activity for that app.
34
34
35
35
- Administrative activity – Search only for administrative activities.
36
36
@@ -56,7 +56,7 @@ Below is a list of the activity filters that can be applied. Most filters suppor
56
56
57
57
- IP address – The raw IP address, category, or tag from which the activity was performed.
58
58
- Raw IP address - Enables you to search for activities that were performed on or by raw IP addresses. The raw IPs can equal, don't equal, start with, or don't start with a particular sequence.
59
-
- IP category - The category of the IP address from which the activity was performed, for example, all activities from the administrative IP address range. The categories need to be configured to include the relevant IP addresses. Some IPs may be categorized by default. for example, there are IP addresses that are considered by Microsoft threat intelligence sources will be categorized as risky. To learn how to configure the IP categories, see [Organize the data according to your needs](ip-tags.md).
59
+
- IP category - The category of the IP address from which the activity was performed, for example, all activities from the administrative IP address range. The categories need to be configured to include the relevant IP addresses. Some IPs might be categorized by default. for example, there are IP addresses that are considered by Microsoft threat intelligence sources will be categorized as risky. To learn how to configure the IP categories, see [Organize the data according to your needs](ip-tags.md).
60
60
- IP tag - The tag of the IP address from which the activity was performed, for example, all activities from anonymous proxy IP addresses. Defender for Cloud Apps creates a set of built-in IP tags that aren't configurable. Additionally, you can configure your IP tags. For more information about configuring your IP tags, see [Organize the data according to your needs](ip-tags.md).
61
61
The built-in IP tags include the following:
62
62
- Microsoft apps (14 of them)
@@ -88,7 +88,7 @@ Below is a list of the activity filters that can be applied. Most filters suppor
88
88
- User domain - Search for a specific user domain.
89
89
- User organization - The organizational unit of the user who performed the activity, for example, all activities performed by EMEA_marketing users. This is only relevant for connected Google Workspace instances using organizational units.
90
90
- User group - Specific user groups that you can import from connected apps, for example, Microsoft 365 administrators.
91
-
- User name - Search for a specific username. To see a list of users in a specific user group, in the **Activity drawer**, select the name of the user group. Clicking will take you to the Accounts page, which lists all the users in the group. From there, you can drill down into the details of the accounts of specific users in the group.
91
+
- User name - Search for a specific username. To see a list of users in a specific user group, in the **Activity drawer**, select the name of the user group. Clicking takes you to the Accounts page, which lists all the users in the group. From there, you can drill down into the details of the accounts of specific users in the group.
92
92
- The **User group** and **User name** filters can be further filtered by using the **As** filter and selecting the role of the user, which can be any of the following:
93
93
- Activity object only - meaning that the user or user group selected didn't perform the activity in question; they were the object of the activity.
94
94
- Actor only - meaning that the user or user group performed the activity.
@@ -132,7 +132,7 @@ Defender for Cloud Apps also provides you with **Suggested queries**. Suggested
132
132
133
133
- Sharing activities - Filters all your activities to display only those activities that involve sharing folders and files, including creating a company link, creating an anonymous link, and granting read/write permissions.
134
134
135
-
- Successful log-in - Filters all your activities to display only those activities that involve successful sign-ins, including impersonate action, impersonate sign-in, single sign-o sign-ins, and sign-in from a new device.
135
+
- Successful login - Filters all your activities to display only those activities that involve successful sign-ins, including impersonate action, impersonate sign-in, single sign-o sign-ins, and sign-in from a new device.
136
136
137
137
138
138
@@ -162,22 +162,59 @@ For example:
162
162
163
163
164
164
165
-
#### Export activities six months back (Preview)
166
165
167
-
You can export all activities from up to six months by clicking the Export button in the top-left corner
166
+
### Export activities six months back (Preview)
167
+
168
+
169
+
You can export all activities from the past six months by clicking the Export button in the top-left corner of the Activity log page.
170
+
168
171
169
172
173
+
When exporting data:
170
174
175
+
- You can choose a date range of up to six months.
176
+
- You can choose to exclude private activities.
177
+
- The exported file is limited to 100,000 records and is delivered in CSV format.
171
178
179
+
Once the export is complete, the file is available under **Exported reports**.
172
180
173
-
When exporting data, you can choose a date range of up to six months, and have the ability to exclude private activities.
174
-
The exported file is limited to 100,000 records and will be in CSV format.
181
+
To access exported files and check export status, navigate to **Reports -> Cloud Apps** in Microsoft 365 Defender portal to view the status of the export process and access past exports.
175
182
176
-
The result file will be accessible under the **Exported reports**. Users can navigate to **Reports -> Cloud Apps** in Microsoft 365 Defender portal to view the status of the export process and access past exports.
177
-
Reports that include private activities will be marked with an Eye icon in the reports page.
183
+
Reports that include private activities are marked with an Eye icon in the reports page.
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/network-requirements.md
+16-12Lines changed: 16 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,13 +1,16 @@
1
1
---
2
2
title: Network requirements
3
3
description: This article describes the IP addresses and ports you need to open to work with Defender for Cloud Apps.
4
-
ms.date: 02/29/2024
4
+
ms.date: 04/06/2025
5
5
ms.topic: reference
6
6
---
7
7
8
8
# Network requirements
9
9
10
-
10
+
>[!IMPORTANT]
11
+
>
12
+
> **Take Immediate Action by April, 21 2025**, to ensure optimal service quality and prevent the interruption of some services. Update your firewall rules to allow outbound traffic on port 443 for the following IP addresses: 13.107.228.0/24, 13.107.229.0/24, 13.107.219.0/24, 13.107.227.0/24, 150.171.97.0/24. Alternatively, if you currently allow outbound traffic based on Azure service tags, please add the new Azure service tag, ‘AzureFrontDoor.MicrosoftSecurity’ to your allowlist. This tag will be adjusted to reflect the above range by April 21, 2025.
13
+
> This change only affects commercial customers of Microsoft Defender for Cloud Apps. Customers connected to the Gov US1 or GCC datacenters won't be affected.
11
14
12
15
This article provides a list of ports and IP addresses you need to allow and allowlist to work with Microsoft Defender for Cloud Apps.
13
16
@@ -16,6 +19,7 @@ In order to stay up to date on IP ranges, it's recommended to refer to the follo
16
19
| Service tag name | Defender for Cloud Apps services included |
17
20
|:---|:---|
18
21
| MicrosoftCloudAppSecurity | Portal access, Access and session controls, SIEM agent connection, App connector, Mail server, Log collector. |
The following tables list the current static IP ranges covered by the MicrosoftCloudAppSecurity service tag. For latest list, refer to the [Azure service tags](/azure/virtual-network/service-tags-overview) documentation.
21
25
@@ -56,11 +60,11 @@ To use Defender for Cloud Apps in the Microsoft Defender Portal:
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/release-notes.md
+7Lines changed: 7 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,6 +7,7 @@ ms.topic: overview
7
7
8
8
# What's new in Microsoft Defender for Cloud Apps
9
9
10
+
>
10
11
*Applies to: Microsoft Defender for Cloud Apps*
11
12
12
13
This article is updated frequently to let you know what's new in the latest release of Microsoft Defender for Cloud Apps.
@@ -19,6 +20,12 @@ For more information on what's new with other Microsoft Defender security produc
19
20
20
21
For news about earlier releases, see [Archive of past updates for Microsoft Defender for Cloud Apps](release-note-archive.md).
21
22
23
+
>[!IMPORTANT]
24
+
>
25
+
> **Take Immediate Action by April, 21 2025**, to ensure optimal service quality and prevent the interruption of some services. This change will only affect your organization if you're using a firewall allowlist that restricts outbound traffic based on IP addresses or Azure service tags. Update your firewall rules to allow outbound traffic on port 443 for the following IP addresses: 13.107.228.0/24, 13.107.229.0/24, 13.107.219.0/24, 13.107.227.0/24, 150.171.97.0/24. Alternatively use as an additional Azure service tag, ‘AzureFrontDoor.MicrosoftSecurity’, that will be adjusted to reflect the above range by April 21, 2025. This update should be completed and the IP addresses or new Azure service tag added to your firewall's allowlist by April 21, 2025.
26
+
> This change only affects commercial customers of Microsoft Defender for Cloud Apps. Customers connected to the Gov US1 or GCC datacenters won't be affected.
0 commit comments