Skip to content

Commit dbec79f

Browse files
authored
Merge pull request #49396 from ceperezb/CEPEREZB-quick-fixes
Ceperezb quick fixes
2 parents 4cae24f + 9485b64 commit dbec79f

File tree

3 files changed

+20
-20
lines changed

3 files changed

+20
-20
lines changed

learn-pr/wwl-sci/design-solutions-secure-microsoft-365/includes/1-introduction-security-exchange-sharepoint-onedrive-teams.md

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -11,37 +11,37 @@ The content in the module helps you prepare for the certification exam SC-100: M
1111
- Advanced experience and knowledge in identity and access, platform protection, security operations, securing data, and securing applications.
1212
- Experience with hybrid and cloud implementations.
1313

14-
## What is Defender for Collaboration security?
14+
## What is Defender for Office 365 security?
1515

1616
Every Office 365 subscription comes with security capabilities. The goals and actions that you can take depend on the focus of these different subscriptions. In Office 365 security, there are three main security services (or products) tied to your subscription type:
1717

1818
1. Exchange Online Protection (EOP)
19-
2. Microsoft Defender for Collaboration Plan 1 (Defender for Office P1)
20-
3. Microsoft Defender for Collaboration Plan 2 (Defender for Office P2)
19+
2. Microsoft Defender for Office 365 Plan 1 (Defender for Office P1)
20+
3. Microsoft Defender for Office 365 Plan 2 (Defender for Office P2)
2121

2222
Office 365 security builds on the core protections offered by EOP. EOP is present in any subscription where Exchange Online mailboxes can be found (remember, all the security products discussed here are Cloud-based).
2323

2424
You may be accustomed to seeing these three components discussed in this way:
2525

26-
|EOP|Microsoft Defender for Collaboration P1|Microsoft Defender for Collaboration P2|
26+
|EOP|Microsoft Defender for Office 365 P1|Microsoft Defender for Office 365 P2|
2727
|---|---|---|
2828
|Prevents broad, volume-based, known attacks.|Protects email and collaboration from zero-day malware, phish, and business email compromise.|Adds post-breach investigation, hunting, and response, as well as automation, and simulation (for training).|
2929

3030
But in terms of architecture, let's start by thinking of each piece as cumulative layers of security, each with a security emphasis. More like this:
3131

32-
![Diagram that shows EOP and Microsoft Defender for Collaboration and their relationships to one another with service emphasis, including a note for email authentication.](../media/office-365-security-diagram.png)
32+
![Diagram that shows EOP and Microsoft Defender for Office 365 and their relationships to one another with service emphasis, including a note for email authentication.](../media/office-365-security-diagram.png)
3333

3434
Though each of these services emphasizes a goal from among Protect, Detect, Investigate, and Respond, _**all**_ the services can carry out _**any**_ of the goals of protecting, detecting, investigating, and responding.
3535

36-
The core of Office 365 security is EOP protection. Microsoft Defender for Collaboration P1 contains EOP in it. Defender for Collaboration P2 contains P1 and EOP. The structure is cumulative. That's why, when configuring this product, you should start with EOP and work to Defender for Office 365.
36+
The core of Office 365 security is EOP protection. Microsoft Defender for Office 365 P1 contains EOP in it. Defender for Office 365 P2 contains P1 and EOP. The structure is cumulative. That's why, when configuring this product, you should start with EOP and work to Defender for Office 365.
3737

38-
Though email authentication configuration takes place in public DNS, it's important to configure this feature to help defend against spoofing. _If you have EOP,_ _**you should [configure email authentication](/microsoft-365/security/office-365-security/email-authentication-about?view=o365-worldwide)**_.
38+
Though email authentication configuration takes place in public DNS, it's important to configure this feature to help defend against spoofing. _If you have EOP,_ _**you should [configure email authentication](/microsoft-365/security/office-365-security/email-authentication-about)**_.
3939

40-
If you have an Office 365 E3, or lower, you have EOP, but with the option to buy standalone Defender for Collaboration P1 through upgrade. If you have Office 365 E5, you already have Defender for Collaboration P2.
40+
If you have an Office 365 E3, or lower, you have EOP, but with the option to buy standalone Defender for Office 365 P1 through upgrade. If you have Office 365 E5, you already have Defender for Office 365 P2.
4141

4242
## The Office 365 security ladder from EOP to Microsoft Defender for Office 365
4343

44-
What makes adding Microsoft Defender for Collaboration plans an advantage to pure EOP threat management can be difficult to tell at first glance. To decide if an upgrade path is right for your organization, let's look at the capabilities of each product when it comes to:
44+
What makes adding Microsoft Defender for Office 365 plans an advantage to pure EOP threat management can be difficult to tell at first glance. To decide if an upgrade path is right for your organization, let's look at the capabilities of each product when it comes to:
4545

4646
- preventing and detecting threats
4747
- investigating
@@ -54,26 +54,26 @@ starting with **Exchange Online Protection**:
5454
|---|---|---|
5555
|Technologies include:<br><br>- spam<br>- phish<br>- malware<br>- bulk mail<br>- spoof intelligence<br>- impersonation detection<br>- Admin Quarantine<br>- False positives and false negative reporting by admin submissions and user reported messages<br>- Allow/Block for URLs and Files<br>- Reports|Audit log search<br>- Message Trace|Zero-hour auto purge (ZAP)<br>- Refinement and testing of Allow and blocklists|
5656

57-
Because these products are cumulative, if you evaluate Microsoft Defender for Collaboration P1 and decide to subscribe to it, you add these abilities.
57+
Because these products are cumulative, if you evaluate Microsoft Defender for Office 365 P1 and decide to subscribe to it, you add these abilities.
5858

5959
Gains with **Defender for Office 365, Plan 1** (to date):
6060
<p>
6161

6262
|Prevent/Detect|Investigate|Respond|
6363
|---|---|---|
64-
|Technologies include everything in EOP plus:<br><br>- Safe attachments<br>- Safe links Microsoft Defender for Collaboration protection for workloads (ex. SharePoint Online, Teams, OneDrive for Business)<br>- Time-of-click protection in email, Office clients, and Teams<br>- anti-phishing in Defender for Office 365<br>- User and domain impersonation protection<br>- Alerts, and SIEM integration API for alerts|SIEM integration API for detections<br>- **Real-time detections tool**<br>- URL trace<br>- Same
64+
|Technologies include everything in EOP plus:<br><br>- Safe attachments<br>- Safe links Microsoft Defender for Office 365 protection for workloads (ex. SharePoint Online, Teams, OneDrive for Business)<br>- Time-of-click protection in email, Office clients, and Teams<br>- anti-phishing in Defender for Office 365<br>- User and domain impersonation protection<br>- Alerts, and SIEM integration API for alerts|SIEM integration API for detections<br>- **Real-time detections tool**<br>- URL trace<br>- Same
6565

66-
So, Microsoft Defender for Collaboration P1 expands on the ***prevention*** side of the house, and adds extra forms of ***detection***.
66+
So, Microsoft Defender for Office 365 P1 expands on the ***prevention*** side of the house, and adds extra forms of ***detection***.
6767

68-
Microsoft Defender for Collaboration P1 also adds **Real-time detections** for investigations. This threat hunting tool's name is in bold, because having it is a clear means of *knowing* you have Defender for Collaboration P1. It doesn't appear in Defender for Collaboration P2.
68+
Microsoft Defender for Office 365 P1 also adds **Real-time detections** for investigations. This threat hunting tool's name is in bold, because having it is a clear means of *knowing* you have Defender for Office 365 P1. It doesn't appear in Defender for Office 365 P2.
6969

7070
Gains with **Defender for Office 365, Plan 2** (to date):
7171
<p>
7272

7373
|Prevent/Detect|Investigate|Respond|
7474
|---|---|---|
75-
|Technologies include everything in EOP, and Microsoft Defender for Collaboration P1 plus:<br><br>- Same|**Threat Explorer**<br>- Threat Trackers<br>- Campaign views|Automated Investigation and Response (AIR)<br>- AIR from Threat Explorer<br>- AIR for compromised users<br>- SIEM Integration API for Automated Investigations|
75+
|Technologies include everything in EOP, and Microsoft Defender for Office 365 P1 plus:<br><br>- Same|**Threat Explorer**<br>- Threat Trackers<br>- Campaign views|Automated Investigation and Response (AIR)<br>- AIR from Threat Explorer<br>- AIR for compromised users<br>- SIEM Integration API for Automated Investigations|
7676

77-
So, Microsoft Defender for Collaboration P2 expands on the ***investigation and response*** side of the house, and adds a new hunting strength. Automation.
77+
So, Microsoft Defender for Office 365 P2 expands on the ***investigation and response*** side of the house, and adds a new hunting strength. Automation.
7878

79-
In Microsoft Defender for Collaboration P2, the primary hunting tool is called **Threat Explorer** rather than Real-time detections. If you see Threat Explorer when you navigate to the Microsoft Defender portal, you're in Microsoft Defender for Collaboration P2.
79+
In Microsoft Defender for Office 365 P2, the primary hunting tool is called **Threat Explorer** rather than Real-time detections. If you see Threat Explorer when you navigate to the Microsoft Defender portal, you're in Microsoft Defender for Office 365 P2.

learn-pr/wwl-sci/design-solutions-secure-microsoft-365/includes/3-design-microsoft-defender-365-solution.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Microsoft Defender XDR is a unified pre- and post-breach enterprise defense suit
33
Here's a list of the different Microsoft Defender XDR products and solutions that Microsoft Defender XDR coordinates with:
44

55
- [**Microsoft Defender for Endpoint**](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint)
6-
- [**Microsoft Defender for Office 365**](/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview?view=o365-worldwide)
6+
- [**Microsoft Defender for Office 365**](/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview)
77
- [**Microsoft Defender for Identity**](/defender-for-identity/what-is)
88
- [**Microsoft Defender for Cloud Apps**](/defender-cloud-apps/what-is-defender-for-cloud-apps)
99
- [**Microsoft Defender Vulnerability Management**](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management)
@@ -17,7 +17,7 @@ Microsoft Defender XDR services protect:
1717

1818
- **Endpoints with Defender for Endpoint** - Defender for Endpoint is a unified endpoint platform for preventative protection, post-breach detection, automated investigation, and response.
1919
- **Assets with Defender Vulnerability Management** - Microsoft Defender Vulnerability Management delivers continuous asset visibility, intelligent risk-based assessments, and built-in remediation tools to help your security and IT teams prioritize and address critical vulnerabilities and misconfigurations across your organization.
20-
- **Email and collaboration with Defender for Office 365** - Defender for Collaboration safeguards your organization against malicious threats posed by email messages, links (URLs) and collaboration tools.
20+
- **Email and collaboration with Defender for Office 365** - Defender for Office 365 safeguards your organization against malicious threats posed by email messages, links (URLs) and collaboration tools.
2121
- **Identities with Defender for Identity and Microsoft Entra ID Protection** - Microsoft Defender for Identity is a cloud-based security solution that leverages your on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization. Microsoft Entra ID Protection uses the learnings Microsoft has acquired from their position in organizations with Microsoft Entra ID, the consumer space with Microsoft Accounts, and in gaming with Xbox to protect your users.
2222
- **Applications with Microsoft Defender for Cloud Apps** - Microsoft Defender for Cloud Apps is a comprehensive cross-SaaS solution bringing deep visibility, strong data controls, and enhanced threat protection to your cloud apps.
2323

@@ -27,7 +27,7 @@ Here's an example of how the Microsoft Defender portal correlates all related al
2727

2828
Here's an example of the list of related alerts for an incident.
2929

30-
:::image type="content" source="../media/incident-list.png" alt-text="Screenshot showint the list of alerts for an incident." border="true":::
30+
:::image type="content" source="../media/incident-list.png" alt-text="Screenshot showing the list of alerts for an incident." border="true":::
3131

3232
Here's an example of query-based hunting on top of email and endpoint raw data.
3333

learn-pr/wwl-sci/design-solutions-secure-microsoft-365/includes/8-summary.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ You learned how to:
66

77
## Learn more with security documentation
88

9-
- [Office 365 Security including Microsoft Defender for Collaboration and Exchange Online Protection - Office 365](/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview)
9+
- [Office 365 Security including Microsoft Defender for Office 365 and Exchange Online Protection - Office 365](/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview)
1010
- [Assess your security posture through Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score-improvement-actions)
1111
- [Zero Trust deployment plan with Microsoft 365](/microsoft-365/security/microsoft-365-zero-trust)
1212

0 commit comments

Comments
 (0)