You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/behaviors.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -73,8 +73,8 @@ The behaviors schema in the **Advanced hunting** page is similar to the [alerts
73
73
74
74
|Table name |Description |
75
75
|---------|---------|
76
-
|[BehaviorInfo ](/microsoft-365/security/defender/advanced-hunting-behaviorinfo-table)| Record per behavior with its metadata, including behavior title, MITRE Attack categories, and techniques. |
77
-
|[BehaviorEntities ](/microsoft-365/security/defender/advanced-hunting-behaviorentities-table)| Information on the entities that were part of the behavior. Can be multiple records per behavior. |
76
+
|[BehaviorInfo ](/microsoft-365/security/defender/advanced-hunting-behaviorinfo-table)| Record per behavior with its metadata, including behavior title, MITRE Attack categories, and techniques. (Not available for GCC.) |
77
+
|[BehaviorEntities ](/microsoft-365/security/defender/advanced-hunting-behaviorentities-table)| Information on the entities that were part of the behavior. Can be multiple records per behavior. (Not available for GCC.)|
78
78
79
79
To get complete information on a behavior and its entities, use `BehaviorId` as the primary key for the join. For example:
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/in-browser-protection.md
+47-49Lines changed: 47 additions & 49 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: In-browser protection with Microsoft Edge for Business | Microsoft Defender for Cloud Apps
3
3
description: Learn about using in-browser protection with Microsoft Defender for Cloud Apps session policies and Microsoft Edge for Business.
4
-
ms.date: 03/04/2024
4
+
ms.date: 10/31/2024
5
5
ms.topic: conceptual
6
6
#customerIntent: As a Defender for Cloud Apps admin, I want to learn about the user experience with in-browser protection.
7
7
---
@@ -14,98 +14,96 @@ Protected users experience a smooth experience with their cloud apps, without la
14
14
15
15
## In-browser protection requirements
16
16
17
-
To use in-browser protection, users must be in their browser's work profile.
17
+
To use in-browser protection, users must be in their browser's work profile.
18
18
19
19
Microsoft Edge profiles allow users to split browsing data into separate profiles, where the data that belongs to each profile is kept separate from the other profiles. For example, when users have different profiles for personal browsing and work, their personal favorites and history aren't synchronized with their work profile.
20
20
21
21
When users have separate profiles, their work browser (Microsoft Edge for Business) and personal browser (Microsoft Edge) have separate caches and storage locations, and information remains separate.
22
22
23
23
To use in-browser protection, users must also have the following environmental requirements in place:
24
24
25
-
|Requirement|Description|
26
-
|---------|---------|
27
-
|**Operating systems**|Windows 10 or 11, macOS|
28
-
|**Identity platform**|Microsoft Entra ID|
29
-
|**Microsoft Edge for Business versions**|The last 2 stable versions (for example, if the newest Edge is 126, in-browser protection works for v126 and v125). <br> See [Microsoft Edge releases](https://learn.microsoft.com/deployedge/microsoft-edge-release-schedule#microsoft-edge-releases)|
30
-
|**Supported session policies**| - Block\Monitor of file download (all files\sensitive files) <br>- Block\Monitor file upload (all files\sensitive files) <br>- Block\Monitor copy\cut\paste <br>- Block\Monitor print <br>- Block\Monitor malware upload <br>- Block\Monitor malware download <br><br> Users that are served by multiple policies, including at least one policy that's *not* supported by Microsoft Edge for Business, their sessions are always served by the reverse proxy. <br><br>Policies defined in the Microsoft Entra ID portal are also always served by reverse proxy.|
25
+
|Requirement|Description|
26
+
|---|---|
27
+
|**Operating systems**|Windows 10 or 11, macOS|
28
+
|**Identity platform**|Microsoft Entra ID|
29
+
|**Microsoft Edge for Business versions**|The last two stable versions. For example, if the newest Microsoft Edge is 126, in-browser protection works for v126 and v125. <br> For more information, see [Microsoft Edge releases](/deployedge/microsoft-edge-release-schedule#microsoft-edge-releases).|
30
+
|**Supported session policies**|<ul><li>Block\Monitor of file download (all files\sensitive files)</li><li>Block\Monitor file upload (all files\sensitive files)</li><li>Block\Monitor copy\cut\paste</li><li>Block\Monitor print</li><li>Block\Monitor malware upload</li><li>Block\Monitor malware download</li></ul> <br> Users that are served by multiple policies, including at least one policy that's *not* supported by Microsoft Edge for Business, their sessions are always served by the reverse proxy. <br><br>Policies defined in the Microsoft Entra ID portal are also always served by reverse proxy.|
31
31
32
32
All other scenarios are served automatically with the standard reverse proxy technology, including user sessions from browsers that don't support in-browser protection, or for policies not supported by in-browser protection.
33
33
34
34
For instance, these scenarios are served by the reverse proxy:
35
-
- Google Chrome users
36
-
- Microsoft Edge users who are scoped to a protect file download policy
37
-
- Microsoft Edge users on Android devices
38
-
- Users in apps that use the OKTA authentication method
39
-
- Microsoft Edge users in InPrivate mode
40
-
- Microsoft Edge users with older browser versions
41
-
- B2B guest users
42
-
- Session is scoped to conditional access policy defined in Microsoft Entra ID portal
35
+
36
+
- Google Chrome users.
37
+
- Microsoft Edge users who are scoped to a protect file download policy.
38
+
- Microsoft Edge users on Android devices.
39
+
- Users in apps that use the OKTA authentication method.
40
+
- Microsoft Edge users in InPrivate mode.
41
+
- Microsoft Edge users with older browser versions.
42
+
- B2B guest users.
43
+
- Session is scoped to a Conditional Access policy defined in Microsoft Entra ID portal.
43
44
44
45
## User experience with in-browser protection
45
46
46
-
To confirm that in-browser protection is active, users need to click on the “lock” icon in the browser's address bar and look for the “suitcase” symbol in the form that appears. The symbol indicates that the session is protected by Defender for Cloud Apps. For example:
47
+
To confirm that in-browser protection is active, users need to select the "lock" icon in the browser's address bar and look for the "suitcase" symbol in the form that appears. The symbol indicates that the session is protected by Defender for Cloud Apps. For example:
47
48
48
-
49
+
49
50
50
51
Also, the `.mcas.ms` suffix doesn't appear in the browser address bar with in-browser protection, as it does with standard Conditional Access app control, and developer tools are turned off with in-browser protection.
51
52
52
53
### Work profile enforcement for in-browser protection
53
54
54
-
To access a work resource in *contoso.com* with in-browser protection, users must sign in with their *[email protected]* profile. If users try to access the work resource from outside the work profile, they're prompted to switch to the work profile or create one if it doesn't exist. Users can also choose to continue with their current profile, in which case they're served by the [reverse proxy architecture](proxy-intro-aad.md).
55
+
To access a work resource in *contoso.com* with in-browser protection, users must sign in with their `[email protected]` profile. If users try to access the work resource from outside the work profile, they're prompted to switch to the work profile or create one if it doesn't exist. Users can also choose to continue with their current profile, in which case they're served by the [reverse proxy architecture](proxy-intro-aad.md).
55
56
56
57
If the user decides to create a new work profile, they're prompted with the **Allow my organization to manage my device** option. In such cases, users don't need to select this option to create the work profile or benefit from in-browser protection.
57
58
58
-
For more information, see [Microsoft Edge for Business](/deployedge/microsoft-edge-for-business) and [How to add new profiles to Microsoft Edge](https://www.microsoft.com/en-us/edge/learning-center/how-to-add-new-profiles).
59
+
For more information, see [Microsoft Edge for Business](/deployedge/microsoft-edge-for-business) and [How to add new profiles to Microsoft Edge](https://www.microsoft.com/edge/learning-center/how-to-add-new-profiles).
59
60
60
61
## Configure in-browser protection settings
61
62
62
-
In-browser protection with Microsoft Edge for Business is turned on by default. Admins can turn the integration off and on, and can configure a prompt for non-Edge users to switch to Microsoft Edge for enhanced performance and security.
63
-
64
-
**To configure in-browser protection settings:**
65
-
66
-
1. In the Microsoft Defender portal, select **Settings > Cloud Apps > Conditional Access App Control > Edge for Business protection**.
63
+
In-browser protection with Microsoft Edge for Business is turned on by default. Admins can turn the integration off and on, and can configure a prompt for non-Microsoft Edge users to switch to Microsoft Edge for enhanced performance and security.
67
64
68
-
1.Configure the following settings as needed:
65
+
1.In the Microsoft Defender portal at <https://security.microsoft.com>, go to **System**\>**Settings**\>**Cloud apps**\>**Conditional Access App Control** section \>**Edge for Business protection**. Or, to go directly to the **Edge for Business protection** page, use <https://security.microsoft.com/cloudapps/settings?tabid=edgeIntegration>.
69
66
70
-
- Toggle the **Turn on Edge for Business protection** option **Off** or **On**.
71
-
- Select to **Notify users in non-Edge browsers to use Microsoft Edge for Business for better performance and security**.
67
+
2. On the **Edge for Business protection** page, configure the following settings as needed:
68
+
-**Turn on Edge for Business browser protection**: The default value is **On**, but you can toggle the setting to **Off**.
69
+
-**Notify users in non-Edge browsers to use Microsoft Edge for Business for better performance and security**: If you select the check box, select one of the following values that appear:
70
+
-**Use default message** (default)
71
+
-**Customize message**: Enter the custom text in the box that appears.
72
72
73
-
If you selected to notify non-Edge users, select to either use the default message or customize your own message.
73
+
Use the **Preview** link to see the notification.
74
74
75
-
1. Select **Save** when you're done to save your changes.
75
+
When you're finished on the **Edge for Business protection** page, select **Save**.
76
76
77
77
## Working with Microsoft Purview and Endpoint data loss prevention
78
78
79
79
If the same exact context and action are configured for both Defender for Cloud Apps policies and a Microsoft Purview Endpoint data loss prevention policy (DLP), the Endpoint DLP policy is applied.
80
80
81
-
For example, if you have an Endpoint DLP policy that blocks a file upload to Salesforce, and you also have a Defender for Cloud Apps policy that monitors file uploads to Salesforce, the Endpoint DLP policy is applied.
81
+
For example, you have an Endpoint DLP policy that blocks a file upload to Salesforce, and you also have a Defender for Cloud Apps policy that monitors file uploads to Salesforce. In this scenario, the Endpoint DLP policy is applied.
82
82
83
83
For more information, see [Learn about data loss prevention](/purview/dlp-learn-about-dlp).
84
84
85
-
## Enforce Edge in-browser when accessing business apps
86
-
Administrators who understand the power of Edge in-browser protection, can require their users to use Edge when accessing corporate resources.
87
-
A primary reason is security, since the barrier to circumventing session controls using Edge is much higher than with reverse proxy technology.
85
+
## Enforce Microsoft Edge browser protection when accessing business apps
86
+
87
+
Administrators who understand the power of Microsoft Edge browser protection can require users to use Microsoft Edge when accessing corporate resources. A primary reason is security, since the barrier to circumventing session controls using Microsoft Edge is much higher than with reverse proxy technology.
88
+
89
+
1. In the Microsoft Defender portal at <https://security.microsoft.com>, go to **System**\>**Settings**\>**Cloud apps**\>**Conditional Access App Control** section \>**Edge for Business protection**. Or, to go directly to the **Edge for Business protection** page, use <https://security.microsoft.com/cloudapps/settings?tabid=edgeIntegration>.
88
90
89
-
Admin experience
90
-
The feature is controlled through the following settings:
91
-
M365 Defender > Settings > Cloud Apps > Edge for Business protection > Enforce usage of Edge for business
91
+
2. On the **Edge for Business protection** page, as long as **Turn on Edge for Business browser protection** is on, **Enforce usage of Edge for Business** is available with the following values:
92
+
-**Do not enforce** (default)
93
+
-**Allow access only from Edge**: Access to the business application (scoped to session policies) is available only via the Microsoft Edge browser.
94
+
-**Enforce access from Edge when possible**: Users should use Microsoft Edge to access the application if their context permits. Otherwise, they might use a different browser to access the protected application.
92
95
93
-
The following options are available:
94
-
- Do not enforce (default)
95
-
- Allow access only from Edge
96
-
- Enforce access from Edge when possible
96
+
For example, a user is subject to a policy that doesn't align with in-browser protection capabilities (for example, **Protect file upon download**) OR the operating system is incompatible (for instance, Android).
97
97
98
-
Admins have the option to apply policies on all devices or only on unmanaged devices.
98
+
In this scenario, because the user lacks control over the context, they might opt to use a different browser.
99
99
100
-
**Allow access only from Edge** means that access to the business application, scoped to session policies, can only be obtained via the Edge browser.
100
+
If the applicable policies allow it and the operating system is compatible (Windows 10, 11, macOS), the user is required to use Microsoft Edge.
101
101
102
-
**Enforce access from Edge when possible** means that users should use Edge to access the application if their context permits, but if not, they may use a different browser to access the protected application.
102
+
3. If you select **Allow access only from Microsoft Edge** or **Enforce access from Microsoft Edge when possible**, the **Enforce for which devices?** setting is available with the following values:
103
+
-**All devices** (default)
104
+
-**Unmanaged devices only**
103
105
104
-
For example:
105
-
If a user is subject to a policy that does not align with in-browser protection capabilities (such as, 'Protect file upon download'), OR
106
-
the Operating System is incompatible (for instance, Android).
107
-
In that scenario, because the user lacks control over the context, they may opt to use a different browser.
108
-
If the policies applicable to him allow it and the operating system is compatible (Windows 10, 11, macOS), then he is required to utilize Edge.
106
+
4. When you're finished on the **Edge for Business protection** page, select **Save**.
Copy file name to clipboardExpand all lines: defender-endpoint/attack-surface-reduction.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -93,7 +93,7 @@ Warn mode is supported on devices running the following versions of Windows:
93
93
94
94
Microsoft Defender Antivirus must be running with real-time protection in [Active mode](/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility#functionality-and-features-available-in-each-state).
95
95
96
-
Also, make sure [Microsoft Defender Antivirus and antimalware updates](/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus#monthly-platform-and-engine-versions) are installed.
96
+
Also, make sure [Microsoft Defender Antivirus and antimalware updates](/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus#platform-and-engine-releases) are installed.
Copy file name to clipboardExpand all lines: defender-endpoint/comprehensive-guidance-on-linux-deployment.md
-5Lines changed: 0 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,11 +19,6 @@ ms.date: 10/28/2024
19
19
20
20
# Advanced deployment guidance for Microsoft Defender for Endpoint on Linux
21
21
22
-
**Applies to:**
23
-
24
-
-[Microsoft Defender for Endpoint Plan 1](microsoft-defender-endpoint.md)
25
-
-[Microsoft Defender for Endpoint Plan 2](microsoft-defender-endpoint.md)
26
-
27
22
This article provides advanced deployment guidance for Microsoft Defender for Endpoint on Linux. You get a brief summary of the deployment steps, learn about the system requirements, then be guided through the actual deployment steps. You'll also learn how to verify that the device has been correctly onboarded.
28
23
29
24
For information about Microsoft Defender for Endpoint capabilities, see [Advanced Microsoft Defender for Endpoint capabilities](#advanced-microsoft-defender-for-endpoint-capabilities).
0 commit comments