You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/discovered-apps-api-graph.md
+6-7Lines changed: 6 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,17 +2,16 @@
2
2
title: Work with discovered apps via Graph API | Microsoft Defender for Cloud Apps
3
3
description: Learn how to work with apps discovered by Microsoft Defender for Cloud Apps via Graph API.
4
4
ms.topic: how-to #Don't change
5
-
ms.date: 06/24/2024
6
-
5
+
ms.date: 06/18/2025
7
6
#customer intent: As a security engineer, I want to work with discovered apps via API so that I can customize and automate the Microsoft Defender for Cloud Apps **Discovered apps** page functionality.
8
-
9
7
---
10
8
11
9
# Work with discovered apps via Graph API (Preview)
12
10
13
11
Microsoft Defender for Cloud Apps supports a Microsoft Graph API that you can use to work with discovered cloud apps, to customize and automate the **Discovered apps** page functionality in the Microsoft Defender portal.
14
12
15
-
This article provides sample procedures for using the [uploadedStreams API](/graph/api/security-datadiscoveryreport-list-uploadedstreams?view=graph-rest-beta) for common purposes.
13
+
This article provides sample procedures for using the [uploadedStreams API](/graph/api/security-datadiscoveryreport-list-uploadedstreams?view=graph-rest-beta&preserve-view=true&tabs=http) for common purposes.
14
+
16
15
17
16
## Prerequisites
18
17
@@ -22,7 +21,7 @@ Before you start using the Graph API, make sure to create an app and get an acce
22
21
23
22
- Take note of your app secret and copy its value to use later on in your scripts.
24
23
25
-
You'll also need cloud app data streaming into Microsoft Defender for Cloud Apps.
24
+
- You need cloud app data streaming into Microsoft Defender for Cloud Apps.
26
25
27
26
For more information, see:
28
27
@@ -36,7 +35,7 @@ For more information, see:
36
35
To get a high level summary of all the data available on your **Discovered apps** page, run the following GET command:
37
36
38
37
```http
39
-
GET https://graph.microsoft.com/beta/dataDiscovery/cloudAppDiscovery/uploadedStreams
38
+
GET https://graph.microsoft.com/beta/security/dataDiscovery/cloudAppDiscovery/uploadedStreams
40
39
```
41
40
42
41
To drill down to data for a specific stream:
@@ -88,4 +87,4 @@ GET https://graph.microsoft.com/beta/security/dataDiscovery/cloudAppDiscovery
88
87
89
88
## Related content
90
89
91
-
For more information, see [Working with discovered apps](discovered-apps.md) and the [Microsoft Graph API reference](/graph/api/resources/security-cloudappdiscovery-overview?view=graph-rest-beta).
90
+
For more information, see [Working with discovered apps](discovered-apps.md) and the [Microsoft Graph API reference](/graph/api/resources/security-cloudappdiscovery-overview?view=graph-rest-beta&preserve-view=true).
| Windows 10, version 2004 or later<br/>Windows Server 2012 R2 and Windows Server 2016 with the [modern unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2)<br/>Windows Server 2019 or later | older than 1.329.495.0 |Feature not available | Audit mode (2)|
124
+
| Windows 10, version 2004 or later<br/>Windows Server 2012 R2 and Windows Server 2016 with the [modern unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2)<br/>Windows Server 2019 or later |Older than 1.329.495.0 |Feature not available | Audit mode (2)|
125
125
| Windows 11, version 22H2 or later | 1.329.495.0 or later | Available | Audit mode (2)|
126
-
| Windows 10, version 2004 or later<br/>Windows Server 2012 R2 and Windows Server 2016 with the [modern unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2)<br/>Windows Server 2019 or later | 1.329.495.0 or later |Feature not available | Block mode (1)|
126
+
| Windows 10, version 2004 or later<br/>Windows Server 2012 R2 and Windows Server 2016 with the [modern unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2)<br/>Windows Server 2019 or later | 1.329.495.0 or later |Feature not available | Block mode (1)|
127
127
128
128
> [!TIP]
129
129
> To enforce PUA protection in block mode, use any of the following management methods:
description: Learn about how SharePoint detects viruses in files that users upload and prevents users from downloading or syncing the files.
19
+
description: Learn about how SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams detect viruses in uploaded files and prevent users from downloading or syncing the files.
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
26
+
26
27
---
27
28
28
-
# Built-in virus protection in SharePoint, OneDrive, and Microsoft Teams
29
+
# Built-in virus protection in SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams
Microsoft 365 uses a common virus detection engine for scanning files that users upload to SharePoint, OneDrive, and Microsoft Teams. This protection is included with all subscriptions that include SharePoint, OneDrive, and Microsoft Teams.
33
+
Microsoft 365 uses a common virus detection engine for scanning files that users upload to SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams. This protection is included with all subscriptions that include SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams.
33
34
34
35
> [!IMPORTANT]
35
36
> The built-in anti-virus capabilities are a way to help contain viruses. They aren't intended as a single point of defense against malware for your environment. We encourage all customers to investigate and implement anti-malware protection at various layers and apply best practices for securing their enterprise infrastructure.
36
37
37
-
## What happens if an infected file is uploaded to SharePoint?
38
+
## What happens if an infected file is uploaded to SharePoint, SharePoint Embedded, OneDrive, or from Microsoft Teams?
38
39
39
-
The Microsoft 365 virus detection engine scans files asynchronously (at some time after upload). If a user tries to download a file in a web browser or from Teams that hasn't been scanned, a scan is triggered before the download is allowed. **All file types are not automatically scanned**. Heuristics determine the files to scan. When a file is found to contain a virus, the file is flagged.
40
+
The Microsoft 365 virus detection engine scans files asynchronously (at some time after upload). If a user tries to download a file in a web browser or from Microsoft Teams that hasn't been scanned, a scan is triggered before the download is allowed. **All files are not automatically scanned**. Anti-malware heuristics determine the files to scan. When a file is found to contain a virus, the file is flagged as containing malware.
40
41
41
42
Here's what happens:
42
43
43
-
1. A user uploads a file to SharePoint.
44
-
2. SharePoint, as part of its virus scanning processes, later determines if the file meets the criteria for a scan.
44
+
1. A user uploads a file to SharePoint, SharePoint Embedded, OneDrive, or from Microsoft Teams.
45
+
2. SharePoint using the common Microsoft 365 anti-malware engine, as part of its virus scanning processes, later determines if the file meets the criteria for a scan.
45
46
3. If the file meets the criteria for a scan, the virus detection engine scans the file.
46
47
4. If a virus is found within the scanned file, the virus engine sets a property on the file that indicates the file is infected.
47
48
48
-
## What happens when a user tries to download an infected file by using the browser?
49
+
## What happens when a user tries to download an infected file by using their web browser?
49
50
50
-
By default, users can download infected files from SharePoint. Here's what happens:
51
+
By default, users can download infected files from SharePoint or OneDrive. Here's what happens:
51
52
52
-
1. In a web browser, a user tries to download a file from SharePoint that happens to be infected.
53
+
1. In a web browser, a user tries to download a file from SharePoint or OneDrive that happens to be infected.
53
54
2. The user is shown a warning that a virus was detected in the file. The user is given the option to proceed with the download and attempt to clean it using anti-virus software on their device.
54
55
55
-
To change this behavior so users can't download infected files, even from the anti-virus warning window, admins can use the *DisallowInfectedFileDownload* parameter on the **[Set-SPOTenant](/powershell/module/sharepoint-online/Set-SPOTenant)** cmdlet in SharePoint Online PowerShell. The value $true for the *DisallowInfectedFileDownload* parameter completely blocks access to detected/blocked files for users.
56
+
To change this behavior so users can't download infected files from SharePoint or OneDrive, even from the anti-virus warning window, admins can use the *DisallowInfectedFileDownload* parameter on the **[Set-SPOTenant](/powershell/module/sharepoint-online/Set-SPOTenant)** cmdlet in SharePoint Online PowerShell. The value $true for the *DisallowInfectedFileDownload* parameter completely blocks access to detected/blocked files for users.
56
57
57
58
For instructions, see [Use SharePoint Online PowerShell to prevent users from downloading malicious files](safe-attachments-for-spo-odfb-teams-configure.md#step-2-recommended-use-sharepoint-online-powershell-to-prevent-users-from-downloading-malicious-files).
58
59
59
-
## Can admins bypass *DisallowInfectedFileDownload* and extract infected files?
60
+
## Can admins bypass *DisallowInfectedFileDownload* and extract infected files from SharePoint or OneDrive?
60
61
61
-
SharePoint admins and global admins<sup>\*</sup> are allowed to do forensic file extractions of malware-infected files in SharePoint Online PowerShell with the [Get-SPOMalwareFileContent](/powershell/module/sharepoint-online/get-spomalwarefilecontent) cmdlet. Admins don't need access to the site that hosts the infected content. As long as the file is marked as malware, admins can use **Get-SPOMalwareFileContent** to extract the file.
62
+
Members of the SharePoint Administrator or Global Administrator roles in Microsoft Entra ID<sup>\*</sup> are allowed to do forensic file extractions of malware-infected files from SharePoint Online PowerShell with the [Get-SPOMalwareFileContent](/powershell/module/sharepoint-online/get-spomalwarefilecontent) cmdlet. Admins don't need access to the site that hosts the infected content. As long as the file is marked as malware, admins can use **Get-SPOMalwareFileContent** to extract the file.
62
63
63
64
For more information about the infected file, admins can use the **[Get-SPOMalwareFile](/powershell/module/sharepoint-online/get-spomalwarefile)** cmdlet to see the type of malware that was detected and the status of the infection.
64
65
65
66
> [!IMPORTANT]
66
67
> <sup>\*</sup> Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
67
68
68
-
## What happens when the OneDrive sync client tries to sync an infected file?
69
+
## What happens when the OneDrive sync client tries to sync an infected file from SharePoint or OneDrive?
69
70
70
-
When a malicious file is uploaded to OneDrive, the file is synced to the local machine before being marked as malware. After the file is marked as malware, the user can't open the synced file from their local machine.
71
+
When a malicious file is uploaded to SharePoint or OneDrive, the file might be synced to the local machine before being marked as malware. After the file is marked as malware, the user can't open the synced file from their local machine.
71
72
72
73
## Extended capabilities with Microsoft Defender for Office 365
73
74
74
-
Microsoft 365 organizations that have [Microsoft Defender for Office 365](mdo-about.md) included in their subscription or purchased as an add-on can enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams for enhanced reporting and protection. For more information, see [Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](safe-attachments-for-spo-odfb-teams-about.md).
75
+
Microsoft 365 organizations that have [Microsoft Defender for Office 365](mdo-about.md) included in their subscription or purchased as an add-on can enable Safe Attachments for SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams for enhanced reporting and protection. For more information, see [Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](safe-attachments-for-spo-odfb-teams-about.md).
75
76
76
77
## Related articles
77
78
78
79
[Malware and ransomware protection in Microsoft 365](/compliance/assurance/assurance-malware-and-ransomware-protection)
79
80
80
-
[Turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](safe-attachments-for-spo-odfb-teams-configure.md).
81
+
[Turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](/defender-office-365/safe-attachments-for-spo-odfb-teams-configure)
82
+
83
+
[Introduction to SharePoint and OneDrive in Microsoft 365 for administrators](/sharepoint/introduction)
84
+
85
+
[Overview of SharePoint Embedded](/sharepoint/dev/embedded/overview)
Copy file name to clipboardExpand all lines: defender-office-365/reports-defender-for-office-365.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -112,7 +112,7 @@ The **Post-delivery activities** report shows information about email messages t
112
112
113
113
The report shows real-time information with updated threat information.
114
114
115
-
On the **Email & collaboration reports** page at <https://security.microsoft.com/emailandcollabreport>, find **Post-delivery activities**, and then select **View details**. Or, to go directly to the report, use <https://security.microsoft.com/reports/ZapReport>.
115
+
On the **Email & collaboration reports** page at <https://security.microsoft.com/emailandcollabreport>, find **Post-delivery activities**, and then select **View details**. Or, to go directly to the report, use <https://security.microsoft.com/reports/PostDeliveryActivities>.
116
116
117
117
:::image type="content" source="media/post-delivery-activities-widget.png" alt-text="The Post-delivery activities widget on the Email & collaboration reports page." lightbox="media/post-delivery-activities-widget.png":::
0 commit comments