Merge pull request #3420 from MicrosoftDocs/main

Publish main to live, 04/08/25, 10:30 AM PDT

Author: Ruchika-mittal01

defender-endpoint/device-health-microsoft-defender-antivirus-health.md

@@ -6,7 +6,7 @@ ms.service: defender-endpoint
 ms.author: ewalsh
 author: emmwalshh
 ms.localizationpriority: medium
-ms.date: 03/13/2025
+ms.date: 04/08/2025
 manager: deniseb
 audience: ITPro
 ms.collection:
@@ -36,7 +36,7 @@ The Device Health report provides information about the devices in your organiza
 >
 > - Device is onboarded to Microsoft Defender for Endpoint
 > - OS: Windows 10, Windows 11, Windows Server 2012 R2/, 2016 R2/ 2019/2022 (non MMA), MacOS, Linux 
-> - Sense (MsSense.exe): **10.8210.** \*+. See [Prerequisites](#prerequisites) section for related details.
+> - Sense (MsSense.exe): **10.8210.** \*+.
 >
 > For Windows Server 2012 R2 and Windows Server 2016 to appear in device health reports, these devices must be onboarded using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016](onboard-windows-server-2012r2-2016.md#functionality-in-the-modern-unified-solution).
 
@@ -48,7 +48,6 @@ In the Microsoft Defender portal, in the navigation pane, select **Reports**, an
   - [View device health cards](#view-device-health-cards)
   - [Report access permissions](#report-access-permissions)
   - [Microsoft Defender Antivirus health tab](#microsoft-defender-antivirus-health-tab)
-    - [Prerequisites](#prerequisites)
     - [Card functionality](#card-functionality)
       - [New Microsoft Defender Antivirus filter definitions](#new-microsoft-defender-antivirus-filter-definitions)
       - [Export report](#export-report)
@@ -119,20 +118,6 @@ For the three `updates` cards (also known as up-to-date reporting cards), "**No
 - Cloud protection isn't enabled.
 - Device doesn't meet pre-requisites for Antivirus engine or platform version.
 
-### Prerequisites
-
-Up-to-date reporting generates information for devices that meet the following criteria:
-
-* **Windows:**
-  * OS - Windows 10 1809 or later  
-  * Engine version: 1.1.19300.2+  
-  * Platform version: 4.8.2202.1+  
-  * Sense (MsSense.exe): 10.8210.*+  
-
-* **Linux and Mac:**
-  * Platform version: 101.23112.*+  
-
-* **Cloud Protection enabled**
 
 :::image type="content" source="media/device-health-defender-antivirus-health-tab.png" alt-text="Shows the Microsoft Defender Antivirus Health tab." lightbox="media/device-health-defender-antivirus-health-tab.png":::
 
@@ -174,7 +159,7 @@ There are two different export csv functionalities through the portal:
 
 - **Top level export**. You can use the top-level **Export** button to gather an all-up Microsoft Defender Antivirus health report (500-K limit).
 
-:::image type="content" source="media/device-health-defender-antivirus-health-tab-export.png" alt-text="Screenshot that shows the top-level export report button." lightbox="media/device-health-defender-antivirus-health-tab-export.png":::
+  :::image type="content" source="media/device-health-defender-antivirus-health-tab-export.png" alt-text="Screenshot that shows the top-level export report button." lightbox="media/device-health-defender-antivirus-health-tab-export.png":::
 
 - **Flyout level export**. You can use the **Export** button within the flyouts to export a report to an Excel spreadsheet (100-K limit).
 
@@ -288,14 +273,15 @@ For more information about the aforementioned terms, refer back to the section:
 
 > [!NOTE]
 >
-> Up to date reporting generates information for devices that meet the following criteria:
->
-> - Engine version: `1.1.19300.2` or later
-> - Platform version: `4.18.2202.1` or later
-> - Cloud protection enabled
-> - Windows OS
->
-> Currently up to date reporting is only available for Windows devices. Cross platform devices such as Mac and Linux are listed under `no data available`.>
+> Up-to-date reporting generates information for devices that meet the following criteria:
+> * **Windows:**
+>    * OS - Windows 10 1809 or later
+>    * Engine version: 1.1.19300.2+  
+>    * Platform version: 4.8.2202.1+  
+>    * Sense (MsSense.exe): 10.8210.*+  
+> * **Linux and Mac:**
+>    * Platform version: 101.23112.*+  
+> * **Cloud Protection enabled**
 
 ##### Up-to-date definitions
 

defender-endpoint/linux-whatsnew.md

@@ -6,7 +6,7 @@ ms.author: ewalsh
 author: emmwalshh
 ms.reviewer: kumasumit, gopkr
 ms.localizationpriority: medium
-ms.date: 03/11/2025
+ms.date: 04/08/2025
 manager: deniseb
 audience: ITPro
 ms.collection:
@@ -43,17 +43,33 @@ This article is updated frequently to let you know what's new in the latest rele
 
 ## Releases for Defender for Endpoint on Linux
 
+### April-2025 Build: 101.25022.0001 | Release version: 30.125022.0001.0
+
+|Build:             |**101.25022.0001**    |
+|-------------------|----------------------|
+|Released:          |**April 07, 2025**    |
+|Published:         |**April 07, 2025**    |
+|Release version:   |**30.125022.0001.0**  |
+|Engine version:    |**1.1.24090.13**      |
+|Signature version: |**1.421.226.0**       |
+
+What's new
+
+- mdatp diagnostic ebpf-statistics command requires sudo privilege now
+
+- Manage dynamic signature file share source by setting URL and update interval
+
+- Other stability improvements and bug fixes.
+
 ### Mar-2025 Build: 101.25012.0000 | Release version: 30.125012.0000.0
 
-| Build:             | **101.25012.0000**    |
-| -------- | -------- |
-|Released:|March 11, 2025|
-|Released:| **March 11, 2025**|
-| Released:          |**March 11, 2025** |
-| Published:         | **March 11, 2025** |
-| Release version:   | **30.125012.0000.0** |
-| Engine version:    | **1.1.24090.13**   |
-| Signature version: | **1.421.226.0**      |
+| Build:            | **101.25012.0000**   |
+|-------------------|----------------------|
+|Released:          | **March 11, 2025**   |
+|Published:         | **March 11, 2025**   |
+|Release version:   | **30.125012.0000.0** |
+|Engine version:    | **1.1.24090.13**     |
+|Signature version: | **1.421.226.0**      |
 
 What's new
 
@@ -66,13 +82,12 @@ What's new
 ### Feb-2025 Build: 101.24122.0008 | Release version: 30.124112.0008.0
 
 | Build:             | **101.24122.0008**    |
-| -------- | -------- |
-|Released:| **February 20, 2025**|
+|--------------------|-----------------------|
 | Released:          | **February 20, 2025** |
 | Published:         | **February 20, 2025** |
-| Release version:   | **30.124122.0008.0** |
-| Engine version:    | **1.1.24090.13**   |
-| Signature version: | **1.421.226.0**      |
+| Release version:   | **30.124122.0008.0**  |
+| Engine version:    | **1.1.24090.13**      |
+| Signature version: | **1.421.226.0**       |
 
 #### What's new
 
@@ -82,12 +97,11 @@ What's new
 ### Feb-2025 Build: 101.24112.0003 | Release version: 30.124112.0003.0
 
 | Build:             | **101.24112.0003**    |
-| -------- | -------- |
-|Released:| February 04, 2025|
+|--------------------|-----------------------|
 | Released:          | **February 04, 2025** |
 | Published:         | **February 04, 2025** |
-| Release version:   | **30.124112.0003.0** |
-| Engine version:    | **1.1.24090.13**        |
+| Release version:   | **30.124112.0003.0**  |
+| Engine version:    | **1.1.24090.13**      |
 | Signature version: | **1.421.1681.0**      |
 
 What's new
@@ -1475,4 +1489,3 @@ As an alternative approach, follow the instructions to [uninstall](linux-resourc
 - Added a new command-line switch (`--ignore-exclusions`) to ignore AV exclusions during custom scans (`mdatp scan custom`)
 - Extended `mdatp diagnostic create` with a new parameter (`--path [directory]`) that allows the diagnostic logs to be saved to a different directory
 - Performance improvements & bug fixes
-

defender-endpoint/mde-linux-prerequisites.md

@@ -15,7 +15,7 @@ ms.collection:
 ms.topic: conceptual
 ms.subservice: linux
 search.appverid: met150
-ms.date: 03/31/2025
+ms.date: 04/08/2025
 ---
 
 # Prerequisites for Microsoft Defender for Endpoint on Linux
@@ -28,7 +28,7 @@ ms.date: 03/31/2025
 Want to experience Microsoft Defender for Endpoint?
 [Sign up for a free trial.](https://go.microsoft.com/fwlink/p/?linkid=2225630&clcid=0x409&culture=en-us&country=us)
 
-This article lists hardware and software requirements for Microsoft Defender for Endpoint on Linux.
+This article lists hardware and software requirements for Defender for Endpoint on Linux. For more information about Defender for Endpoint on Linux, see [Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) and [What's new in Defender for Endpoint on Linux](linux-whatsnew.md). 
 
 ## License requirements
 

defender-office-365/email-authentication-dkim-configure.md

@@ -5,7 +5,7 @@ f1.keywords:
 ms.author: chrisda
 author: chrisda
 manager: deniseb
-ms.date: 1/29/2024
+ms.date: 04/08/2024
 audience: ITPro
 ms.topic: conceptual
 
@@ -93,10 +93,10 @@ The basic syntax of the DKIM CNAME records for custom domains that send mail fro
 
 ```text
 Hostname: selector1._domainkey
-Points to address or value: selector1-<CustomDomain>._domainkey.<InitialDomain>
+Points to address or value: selector1-<CustomDomain>._domainkey.<InitialDomainPrefix>.n-v1.dkim.mail.microsoft
 
 Hostname: selector2._domainkey
-Points to address or value: selector2-<CustomDomain>._domainkey.<InitialDomain>
+Points to address or value: selector2-<CustomDomain>._domainkey.<InitialDomainPrefix>.n-v2.dkim.mail.microsoft
 ```
 
 - In Microsoft 365, two public-private key pairs are generated when DKIM signing using a custom domain or subdomain is enabled. The private keys that are used to sign the message are inaccessible. The CNAME records point to the corresponding public keys that are used to verify the DKIM signature. These records are known as _selectors_.
@@ -109,7 +109,7 @@ Points to address or value: selector2-<CustomDomain>._domainkey.<InitialDomain>
 
 - **\<CustomDomain\>**: The custom domain or subdomain with periods replaced by dashes. For example, `contoso.com` becomes `contoso-com`, or `marketing.contoso.com` becomes `marketing-contoso-com`.
 
-- **\<InitialDomain\>**: The \*.onmicrosoft.com that you used when you enrolled in Microsoft 365 (for example, contoso.onmicrosoft.com).
+- **\<InitialDomainPrefix\>**: The custom part of the \*.onmicrosoft.com you used to enroll in Microsoft 365. For example, if you used `contoso.onmicrosoft.com`, the value is `contoso`.
 
 For example, your organization has the following domains in Microsoft 365:
 
@@ -121,18 +121,18 @@ You need to create two CNAME records in each custom domain, for a total of four
 - **CNAME records in the cohovineyard.com domain**:
 
   **Hostname**: `selector1._domainkey`<br>
-  **Points to address or value**: `selector1-cohovineyard-com._domainkey.cohovineyardandwinery.onmicrosoft.com`
+  **Points to address or value**: `selector1-cohovineyard-com._domainkey.cohovineyardandwinery.n-v1.dkim.mail.microsoft`
 
   **Hostname**: `selector2._domainkey`<br>
-  **Points to address or value**: `selector2-cohovineyard-com._domainkey.cohovineyardandwinery.onmicrosoft.com`
+  **Points to address or value**: `selector2-cohovineyard-com._domainkey.cohovineyardandwinery.n-v2.dkim.mail.microsoft`
 
 - **CNAME records in the cohowinery.com domain**:
 
   **Hostname**: `selector1._domainkey`<br>
-  **Points to address or value**: `selector1-cohowinery-com._domainkey.cohovineyardandwinery.onmicrosoft.com`
+  **Points to address or value**: `selector1-cohowinery-com._domainkey.cohovineyardandwinery.n-v1.dkim.mail.microsoft`
 
   **Hostname**: `selector2._domainkey`<br>
-  **Points to address or value**: `selector2-cohowinery-com._domainkey.cohovineyardandwinery.onmicrosoft.com`
+  **Points to address or value**: `selector2-cohowinery-com._domainkey.cohovineyardandwinery.n-v2.dkim.mail.microsoft`
 
 ## Configure DKIM signing of outbound messages in Microsoft 365
 

defender-office-365/submissions-admin-review-user-reported-messages.md

@@ -61,7 +61,7 @@ Admins can mark messages and notify users of review results only if the user [re
 
 ## Notify users from within the portal
 
-1. In the Microsoft Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Email & collaboration** \> **Submissions**. Or, to go directly to the **Submissions** tab, use <https://security.microsoft.com/reportsubmission>.
+1. In the Microsoft Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & Submissions** \> **Submissions**. Or, to go directly to the **Submissions** tab, use <https://security.microsoft.com/reportsubmission>.
 
 2. On the **Submissions** page, select the **User reported** tab.