You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/use-case-admin-quarantine.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,7 +24,7 @@ In this tutorial, you'll learn how to use Microsoft Defender for Cloud Apps to d
24
24
>
25
25
> - For a list of apps that support admin quarantine, see the list of [governance actions](governance-actions.md).
26
26
> - Files labeled by Defender for Cloud Apps can't be quarantined.
27
-
> - Defender for Cloud Apps admin quarantine actions are limited to 100 actions per day.
27
+
> - Defender for Cloud Apps admin quarantine actions is limited to 100 actions per day.
28
28
> - Sharepoint sites that are renamed either directly or as part of domain rename can't be used as a folder location for admin quarantine.
29
29
30
30
@@ -44,7 +44,7 @@ In this tutorial, you'll learn how to use Microsoft Defender for Cloud Apps to d
44
44
45
45
1. The user can only access the tombstone file. In the file, they can read the custom guidelines provided by IT and the correlation ID to give IT to release the file.
46
46
47
-
1. When you receive the alert that a file has been quarantined, go to **Policies** -> **Policy Management**. Then select the **Information Protection** tab. In the row with your file policy, choose the three dots at the end of the line, and select **View all matches**. This brings you the report of matches, where you can see the matching and quarantined files:
47
+
1. When you receive the alert that a file has been quarantined, go to **Policies** -> **Policy Management**. Then select the **Information Protection** tab. In the row with your file policy, choose the three dots at the end of the line, and select **View all matches**. This brings you the report of matches, where you can see the matching and quarantined files:
@@ -53,7 +53,7 @@ In this tutorial, you'll learn how to use Microsoft Defender for Cloud Apps to d
53
53
1. Inspect the file in the quarantined folder on SharePoint online.
54
54
1. You can also look at the audit logs to deep dive into the file properties.
55
55
1. If you find the file is against corporate policy, run the organization's Incident Response (IR) process.
56
-
1. If you find that the file is harmless, you can restore the file from quarantine. At that point the original file is released, meaning it's copied back to the original location, the tombstone is deleted, and the user can access the file.
56
+
1. If you find that the file is harmless, you can restore the file from quarantine. At that point the original file is released, and copied back to the original location. The tombstone is deleted, and the user can access the file.
> Defender for Cloud Apps will create a quarantine folder on the selected site.
88
+
> Defender for Cloud Apps creates a quarantine folder on the selected site.
89
89
90
90
1. For Box, the quarantine folder location and user message can't be customized. The folder location is the drive of the admin who connected Box to Defender for Cloud Apps and the user message is: This file was quarantined to your administrator's drive because it might violate your company's security and compliance policies. Contact your IT administrator for help.
0 commit comments