Merge branch 'docs-editor/enable-exploit-protection-1731692849' of https://github.com/YongRhee-MSFT/defender-docs-pr into pr/1911

Author: denisebmsft

.acrolinx-config.edn

@@ -1,6 +1,6 @@
 {:changed-files-limit 60
  :allowed-branchname-matches ["main" "release-.*"]
- :allowed-filename-matches ["ATADocs/" "CloudAppSecurityDocs/" "exposure-management/" "defender/" "defender-business/" "defender-endpoint/" "defender-for-cloud/" "defender-for-iot/" "defender-office-365/" "defender-vulnerability-management/" "defender-xdr/"] ;; Can be overridden in repo-specific edn file. This is an allow list that identifies which folders contain the files Acrolinx will check. Separate multiple folders as follows ["folder/" "folder2"]
+ :allowed-filename-matches ["ATADocs/" "CloudAppSecurityDocs/" "defender/" "defender-business/" "defender-endpoint/" "defender-for-cloud/" "defender-for-iot/" "defender-office-365/" "defender-vulnerability-management/" "defender-xdr/" "exposure-management/" "unified-secops-platform/"] ;; Can be overridden in repo-specific edn file. This is an allow list that identifies which folders contain the files Acrolinx will check. Separate multiple folders as follows ["folder/" "folder2"]
 
 :use-gh-statuses true
 

defender-endpoint/android-whatsnew.md

@@ -14,7 +14,7 @@ ms.collection:
 ms.topic: reference
 ms.subservice: android
 search.appverid: met150
-ms.date: 08/26/2024
+ms.date: 11/15/2024
 ---
 
 # What's new in Microsoft Defender for Endpoint on Android
@@ -27,6 +27,19 @@ ms.date: 08/26/2024
 
 Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink)
 
+**Ending support for Device Administrator enrolled devices**
+
+Microsoft Intune and Defender for Endpoint are ending support for Device Administrator enrolled devices with access to [Google Mobile Services](/mem/intune/apps/manage-without-gms) (GMS), beginning December 31, 2024.
+
+**For devices with access to GMS**
+
+After Intune and Defender for Endpoint ends support for Android device administrator, devices with access to GMS will be impacted in the following ways: 
+
+- Intune and Defender for Endpoint won’t make changes or updates to Android device administrator management, such as bug fixes, security fixes, or fixes to address changes in new Android versions.
+- Intune and Defender for Endpoint technical support will no longer support these devices.
+
+For more information, see [Tech Community blog: Intune ending support for Android device administrator on devices with GMS in December 2024](https://techcommunity.microsoft.com/blog/intunecustomersuccess/intune-ending-support-for-android-device-administrator-on-devices-with-gms-in-de/3915443).
+
 **Aug-2024 (version: 1.0.6812.0101)**
 
 - Network Protection feature is enabled by default for all users
@@ -115,7 +128,7 @@ Notify your users and helpdesk (as applicable) that users will need to accept th
 
 2. Tap **Begin**.
 
-3. Tap the toggle for **Allow access to manage all files.**
+1. Tap the toggle for **Allow access to manage all files.**
 
 4. The device is now protected.
 

defender-endpoint/evaluate-exploit-protection.md

@@ -15,7 +15,7 @@ ms.collection:
 - tier2
 - mde-asr
 search.appverid: met150
-ms.date: 12/18/2020
+ms.date: 11/15/2024
 ---
 
 # Evaluate exploit protection
@@ -31,7 +31,56 @@ ms.date: 12/18/2020
 
 [Exploit protection](exploit-protection.md) helps protect devices from malware that uses exploits to spread and infect other devices. Mitigation can be applied to either the operating system or to an individual app. Many of the features that were part of the Enhanced Mitigation Experience Toolkit (EMET) are included in exploit protection. (The EMET has reached its end of support.)
 
-In audit, you can see how mitigation works for certain apps in a test environment. This shows what *would* have happened if you enabled exploit protection in your production environment. This way, you can verify that exploit protection doesn't adversely affect your line-of-business apps, and see which suspicious or malicious events occur.
+In audit, you can see how mitigation works for certain apps in a test environment. This shows what *would* happen if you enable exploit protection in your production environment. This way, you can verify that exploit protection doesn't adversely affect your line-of-business apps, and see which suspicious or malicious events occur.
+
+## Generic guidelines
+
+Exploit protection mitigations work at a low level in the operating system, and some kinds of software that perform similar low-level operations might have compatibility issues when they're configured to be protected by using exploit protection.  
+
+#### What kinds of Software shouldn't be protected by exploit protection?
+
+- Anti-malware and intrusion prevention or detection software
+- Debuggers
+- Software that handles digital rights management (DRM) technologies (that is, video games)
+- Software that use anti-debugging, obfuscation, or hooking technologies
+
+#### What type of applications should you consider enabling exploit protection?
+
+Applications that receive or handle untrusted data.
+
+#### What type of processes are out of scope for exploit protection?
+
+Services
+
+- System services
+- Network services
+
+## Application compatibility list
+
+The following table lists specific products that have compatibility issues with the mitigations that are included in exploit protection. You must disable specific incompatible mitigations if you want to protect the product by using exploit protection. Be aware that this list takes into consideration the default settings for the latest versions of the product.  Compatibility issues can introduced when you apply certain add-ins or other components to the standard software.
+
+| Product | Exploit protection mitigation |
+| -------- | -------- |
+| .NET 2.0/3.5   | EAF/IAF   |
+| 7-Zip Console/GUI/File Manager   | EAF  |
+| AMD 62xx processors  | EAF   |
+| Avecto (Beyond Trust) Power Broker   | EAF, EAF+, Stack Pivot   |
+| Certain AMD (ATI) video drivers   | System ASLR=AlwaysOn   |
+| DropBox   | EAF  |
+| Excel Power Query, Power View, Power Map and PowerPivot   | EAF  |
+| Google Chrome   | EAF+   |
+| Immidio Flex+   | Cell 4   |
+| Microsoft Office Web Components (OWC)   | System DEP=AlwaysOn  |
+| Microsoft PowerPoint   | EAF   |
+| Microsoft Teams   | EAF+   |
+| Oracle Javaǂ  | Heapspray   |
+| Pitney Bowes Print Audit 6   | SimExecFlow  |
+| Siebel CRM version is 8.1.1.9  | SEHOP   |
+| Skype   | EAF  |
+| SolarWinds Syslogd Manager   | EAF  |
+| Windows Media Player   | MandatoryASLR, EAF|
+
+ǂ EMET mitigations might be incompatible with Oracle Java when they're run by using settings that reserve a large chunk of memory for the virtual machine (that is, by using the -Xms option).
 
 ## Enable exploit protection for testing
 
@@ -45,12 +94,14 @@ You can set mitigations in a testing mode for specific programs by using the Win
 
 3. Go to **Program settings** and choose the app you want to apply protection to:
 
-    1. If the app you want to configure is already listed, select it and then select **Edit**
-    2. If the app isn't listed at the top of the list select **Add program to customize**. Then, choose how you want to add the app.
-        - Use **Add by program name** to have the mitigation applied to any running process with that name. Specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
-        - Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
+   1. If the app you want to configure is already listed, select it and then select **Edit**.
+
+   2. If the app isn't listed at the top of the list select **Add program to customize**. Then, choose how you want to add the app.
 
-4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in test mode only. You'll be notified if you need to restart the process, app, or Windows.
+      - Use **Add by program name** to have the mitigation applied to any running process with that name. Specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
+      - Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
+
+4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** applies the mitigation in test mode only. You're notified if you need to restart the process, app, or Windows.
 
 5. Repeat this procedure for all the apps and mitigations you want to configure. Select **Apply** when you're done setting up your configuration.
 
@@ -93,7 +144,7 @@ You can disable **audit mode** by replacing `-Enable` with `-Disable`.
 
 ## Review exploit protection audit events
 
-To review which apps would have been blocked, open Event Viewer and filter for the following events in the Security-Mitigations log.<br/><br/>
+To review which apps would be blocked, open Event Viewer and filter for the following events in the Security-Mitigations log.
 
 |Feature|Provider/source|Event ID|Description|
 |---|---|--|---|
@@ -110,4 +161,5 @@ To review which apps would have been blocked, open Event Viewer and filter for t
 - [Configure and audit exploit protection mitigations](customize-exploit-protection.md)
 - [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md)
 - [Troubleshoot exploit protection](troubleshoot-exploit-protection-mitigations.md)
+
 [!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]