You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/release-notes.md
+11Lines changed: 11 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,6 +19,17 @@ For more information on what's new with other Microsoft Defender security produc
19
19
20
20
For news about earlier releases, see [Archive of past updates for Microsoft Defender for Cloud Apps](release-note-archive.md).
21
21
22
+
## March 2025
23
+
24
+
### RBAC scoping for "Behaviors" (Preview)
25
+
26
+
Defender for Cloud Apps customers can now configure Role-Based Access Control (RBAC) scoping for 'Behaviors'. This new capability empowers administrators to define and manage access permissions more precisely, ensuring that users have the appropriate level of access to specific application data based on their roles and responsibilities. By leveraging RBAC scoping, organizations can enhance their security posture, streamline operations, and reduce the risk of unauthorized access.
- The MDATP package rollout into production will be done gradually. From the time the release notes are published, it might take up to a week for the package to be pushed to all production machines.
61
+
62
+
- The vulnerability in curl, CVE-2024-7264, has been addressed.
- Enabled: When eBPF is enabled as working as expected.
97
117
- Disabled: When eBPF is disabled due to one of the following reasons:
98
118
- When MDE is using auditD as a supplementary sensor
99
-
- When eBPF is not present and we fallback to Netlink as supplementary event provider
100
-
- There is no supplementary sensor present.
119
+
- When eBPF isn't present and we fallback to Netlink as supplementary event provider
120
+
- There's no supplementary sensor present.
101
121
102
-
- Beginning with 2411, the MDATP package release to Production on `packages.microsoft.com` follows a gradual rollout mechanism which spans over a week. The other release rings, insiderFast and insiderSlow, are unaffected by this change.
122
+
- Beginning with 2411, the MDATP package release to Production on `packages.microsoft.com` follows a gradual rollout mechanism which spans over a week. The other release rings, insiderFast, and insiderSlow, are unaffected by this change.
103
123
104
124
- Stability and performance improvements.
105
125
@@ -211,7 +231,7 @@ There are multiple fixes and new changes in this release.
211
231
212
232
There are multiple fixes and new changes in this release.
213
233
214
-
- This release fixes a bug related to high memory usage eventually leading to high CPU due to eBPF memory leak in kernel space resulting in servers going into unusable states. This only impacted the kernel versions 3.10x and <= 4.16x, majorly on RHEL/CentOS distros. Update to the latest MDE version to avoid any impact.
234
+
- This release fixes a bug related to high memory usage eventually leading to high CPU due to eBPF memory leak in kernel space resulting in servers going into unusable states. This only affected the kernel versions 3.10x and <= 4.16x, majorly on RHEL/CentOS distros. Update to the latest MDE version to avoid any impact.
215
235
216
236
- We have now simplified the output of `mdatp health --detail features`
- While upgrading mdatp to version `101.94.13`, you might notice that health is false, with health_issues as "no active supplementary event provider". This can happen due to misconfigured/conflicting auditd rules on existing machines. To mitigate the issue, the auditd rules on the existing machines need to be fixed. The following steps can help you to identify such auditd rules (these commands need to be run as super user). Take a backup of following file: `/etc/audit/rules.d/audit.rules` as these steps are only to identify failures.
1063
+
- While upgrading mdatp to version `101.94.13`, you might notice that health is false, with health_issues as "no active supplementary event provider. This can happen due to misconfigured/conflicting auditd rules on existing machines. To mitigate the issue, the auditd rules on the existing machines need to be fixed. The following steps can help you to identify such auditd rules (these commands need to be run as super user). Take a backup of following file: `/etc/audit/rules.d/audit.rules` as these steps are only to identify failures.
1044
1064
1045
1065
```bash
1046
1066
echo -c >> /etc/audit/rules.d/audit.rules
@@ -1333,7 +1353,7 @@ As an alternative approach, follow the instructions to [uninstall](linux-resourc
1333
1353
1334
1354
##### What's new
1335
1355
1336
-
- Added a capability to detect vulnerable log4j jars in use by Java applications. The machine is periodically inspected for running Java processes with loaded log4j jars. The information is reported to the Microsoft Defender for Endpoint backend and is exposed in the Vulnerability Management area of the portal.
1356
+
- Added a capability to detect vulnerable Log4j jars in use by Java applications. The machine is periodically inspected for running Java processes with loaded Log4j jars. The information is reported to the Microsoft Defender for Endpoint backend and is exposed in the Vulnerability Management area of the portal.
@@ -1343,7 +1363,7 @@ As an alternative approach, follow the instructions to [uninstall](linux-resourc
1343
1363
1344
1364
##### What's new
1345
1365
1346
-
- Added a new switch to the command-line tool to control whether archives are scanned during on-demand scans. This can be configured through mdatp config scan-archives--value [enabled/disabled]. By default, this setting is set to enabled.
1366
+
- Added a new switch to the command-line tool to control whether archives are scanned during on-demand scans. This can be configured through mdatp config scan-archives--value [enabled/disabled]. By default, this setting is set to enabled.
Copy file name to clipboardExpand all lines: defender-endpoint/migrate-devices-streamlined.md
+11-13Lines changed: 11 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,8 +3,8 @@ title: Migrate devices to use the streamlined onboarding method
3
3
description: Learn how to migrate devices to Defender for Endpoint using the streamlined connectivity method.
4
4
search.appverid: met150
5
5
ms.service: defender-endpoint
6
-
ms.author: deniseb
7
-
author: denisebmsft
6
+
ms.author: ewalsh
7
+
author: emmwalshh
8
8
ms.localizationpriority: medium
9
9
manager: deniseb
10
10
audience: ITPro
@@ -13,7 +13,7 @@ ms.collection:
13
13
- tier1
14
14
ms.topic: how-to
15
15
ms.subservice: onboard
16
-
ms.date: 03/06/2025
16
+
ms.date: 03/11/2025
17
17
---
18
18
19
19
# Migrate devices to use the streamlined connectivity method
@@ -31,9 +31,9 @@ This article describes how to migrate (reonboard) devices that had been previous
31
31
In most cases, full device offboarding isn't required when reonboarding. You can run the updated onboarding package and reboot your device to switch connectivity over. See the following information for details on individual operating systems.
32
32
33
33
> [!IMPORTANT]
34
-
> Limitations and known issues:- For device migrations (reonboarding): Offboarding is not required to switch over to streamlined connectivity method. Once the updated onboarding package is run, a full device reboot is required for Windows devices and a service restart for macOS and Linux. For more information, see the details included in this article.
35
-
- Windows 10 versions 1607, 1703, 1709, and 1803 do not support reonboarding. Offboard first and then onboard using the updated package. These versions also require a longer URL list.
36
-
- Devices running the MMA agent are not supported and must continue using the MMA onboarding method.
34
+
> Limitations and known issues:- For device migrations (reonboarding): Offboarding isn't required to switch over to streamlined connectivity method. Once the updated onboarding package is run, a full device reboot is required for Windows devices and a service restart for macOS and Linux. For more information, see the details included in this article.
35
+
- Windows 10 versions 1607, 1703, 1709, and 1803 don't support reonboarding. Offboard first and then onboard using the updated package. These versions also require a longer URL list.
36
+
- Devices running the MMA agent aren't supported and must continue using the MMA onboarding method.
37
37
38
38
39
39
## Migrating devices using the streamlined method
@@ -66,7 +66,7 @@ The following table lists migration instructions for the available onboarding to
66
66
### Windows 10 and 11
67
67
68
68
> [!IMPORTANT]
69
-
> Windows 10 version 1607, 1703, 1709, and 1803 do not support reonboarding. To migrate existing devices, you will need to fully offboard and onboard using the streamlined onboarding package.
69
+
> Windows 10 versions 1607, 1703, 1709, and 1803 don't support reonboarding. To migrate existing devices, you need to fully offboard and onboard using the streamlined onboarding package.
70
70
71
71
For general information on onboarding Windows client devices, see [Onboarding Windows Client](onboard-windows-client.md).
72
72
@@ -220,7 +220,7 @@ Once a device is migrated to use the streamlined method and the device establish
220
220
221
221
If you move the device back to the regular method, the value is "standard".
222
222
223
-
For devices that haven't yet attempted reonboard, the value remains blank.
223
+
For devices that have not attempted to reonboard, the value remains empty.
224
224
225
225
### Tracking locally on a device through Windows Event Viewer
226
226
@@ -252,7 +252,7 @@ Open the Defender for Endpoint service event log using the following steps:
252
252
253
253
> [!NOTE]
254
254
> SENSE is the internal name used to refer to the behavioral sensor that powers Microsoft Defender for Endpoint. <br>
255
-
> Events recorded by the service will appear in the log. <br>
255
+
> Events recorded by the service appear in the log. <br>
256
256
> For more information, see [Review events and error using Event Viewer](event-error-codes.md).
257
257
258
258
### Run tests to confirm connectivity with Defender for Endpoint services
@@ -286,7 +286,7 @@ For Auto-IR testing labs, navigate to **Microsoft Defender XDR** \> **Evaluation
286
286
```
287
287
288
288
> [!NOTE]
289
-
> This command will only work on Windows 10, version 1703 or higher, or Windows 11.
289
+
> This command only works on Windows 10, version 1703 or higher, or Windows 11.
290
290
> For more information, see [Manage Microsoft Defender Antivirus with the mpcmdrun.exe commandline tool](command-line-arguments-microsoft-defender-antivirus.md).
291
291
292
292
#### Test Block at First Sight
@@ -319,9 +319,7 @@ For macOS and Linux, you can use the following methods:
319
319
320
320
### MDATP connectivity test (macOS and Linux)
321
321
322
-
Run `mdatp health -details features` to confirm simplified_connectivity: "enabled".
323
-
324
-
Run `mdatp health -details edr` to confirm `edr_partner_geo_location` is available. The value should be `GW_<geo>` where 'geo' is your tenant's geo-location.
322
+
Run `mdatp health --details edr` to confirm `edr_partner_geo_location` is available. The value should be `GW_<geo>` where 'geo' is your tenant's geo-location.
325
323
326
324
Run mdatp connectivity test. Ensure the streamlined URL pattern is present. You should expect two for '\storage', one for '\mdav', one for '\xplat', and one for '/packages'.
0 commit comments