You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/design-solutions-secure-microsoft-365/includes/1-introduction-security-exchange-sharepoint-onedrive-teams.md
+16-16Lines changed: 16 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,37 +11,37 @@ The content in the module helps you prepare for the certification exam SC-100: M
11
11
- Advanced experience and knowledge in identity and access, platform protection, security operations, securing data, and securing applications.
12
12
- Experience with hybrid and cloud implementations.
13
13
14
-
## What is Defender for Collaboration security?
14
+
## What is Defender for Office 365 security?
15
15
16
16
Every Office 365 subscription comes with security capabilities. The goals and actions that you can take depend on the focus of these different subscriptions. In Office 365 security, there are three main security services (or products) tied to your subscription type:
17
17
18
18
1. Exchange Online Protection (EOP)
19
-
2. Microsoft Defender for Collaboration Plan 1 (Defender for Office P1)
20
-
3. Microsoft Defender for Collaboration Plan 2 (Defender for Office P2)
19
+
2. Microsoft Defender for Office 365 Plan 1 (Defender for Office P1)
20
+
3. Microsoft Defender for Office 365 Plan 2 (Defender for Office P2)
21
21
22
22
Office 365 security builds on the core protections offered by EOP. EOP is present in any subscription where Exchange Online mailboxes can be found (remember, all the security products discussed here are Cloud-based).
23
23
24
24
You may be accustomed to seeing these three components discussed in this way:
25
25
26
-
|EOP|Microsoft Defender for Collaboration P1|Microsoft Defender for Collaboration P2|
26
+
|EOP|Microsoft Defender for Office 365 P1|Microsoft Defender for Office 365 P2|
27
27
|---|---|---|
28
28
|Prevents broad, volume-based, known attacks.|Protects email and collaboration from zero-day malware, phish, and business email compromise.|Adds post-breach investigation, hunting, and response, as well as automation, and simulation (for training).|
29
29
30
30
But in terms of architecture, let's start by thinking of each piece as cumulative layers of security, each with a security emphasis. More like this:
31
31
32
-

32
+

33
33
34
34
Though each of these services emphasizes a goal from among Protect, Detect, Investigate, and Respond, _**all**_ the services can carry out _**any**_ of the goals of protecting, detecting, investigating, and responding.
35
35
36
-
The core of Office 365 security is EOP protection. Microsoft Defender for Collaboration P1 contains EOP in it. Defender for Collaboration P2 contains P1 and EOP. The structure is cumulative. That's why, when configuring this product, you should start with EOP and work to Defender for Office 365.
36
+
The core of Office 365 security is EOP protection. Microsoft Defender for Office 365 P1 contains EOP in it. Defender for Office 365 P2 contains P1 and EOP. The structure is cumulative. That's why, when configuring this product, you should start with EOP and work to Defender for Office 365.
37
37
38
-
Though email authentication configuration takes place in public DNS, it's important to configure this feature to help defend against spoofing. _If you have EOP,__**you should [configure email authentication](/microsoft-365/security/office-365-security/email-authentication-about?view=o365-worldwide)**_.
38
+
Though email authentication configuration takes place in public DNS, it's important to configure this feature to help defend against spoofing. _If you have EOP,__**you should [configure email authentication](/microsoft-365/security/office-365-security/email-authentication-about)**_.
39
39
40
-
If you have an Office 365 E3, or lower, you have EOP, but with the option to buy standalone Defender for Collaboration P1 through upgrade. If you have Office 365 E5, you already have Defender for Collaboration P2.
40
+
If you have an Office 365 E3, or lower, you have EOP, but with the option to buy standalone Defender for Office 365 P1 through upgrade. If you have Office 365 E5, you already have Defender for Office 365 P2.
41
41
42
42
## The Office 365 security ladder from EOP to Microsoft Defender for Office 365
43
43
44
-
What makes adding Microsoft Defender for Collaboration plans an advantage to pure EOP threat management can be difficult to tell at first glance. To decide if an upgrade path is right for your organization, let's look at the capabilities of each product when it comes to:
44
+
What makes adding Microsoft Defender for Office 365 plans an advantage to pure EOP threat management can be difficult to tell at first glance. To decide if an upgrade path is right for your organization, let's look at the capabilities of each product when it comes to:
45
45
46
46
- preventing and detecting threats
47
47
- investigating
@@ -54,26 +54,26 @@ starting with **Exchange Online Protection**:
54
54
|---|---|---|
55
55
|Technologies include:<br><br>- spam<br>- phish<br>- malware<br>- bulk mail<br>- spoof intelligence<br>- impersonation detection<br>- Admin Quarantine<br>- False positives and false negative reporting by admin submissions and user reported messages<br>- Allow/Block for URLs and Files<br>- Reports|Audit log search<br>- Message Trace|Zero-hour auto purge (ZAP)<br>- Refinement and testing of Allow and blocklists|
56
56
57
-
Because these products are cumulative, if you evaluate Microsoft Defender for Collaboration P1 and decide to subscribe to it, you add these abilities.
57
+
Because these products are cumulative, if you evaluate Microsoft Defender for Office 365 P1 and decide to subscribe to it, you add these abilities.
58
58
59
59
Gains with **Defender for Office 365, Plan 1** (to date):
60
60
<p>
61
61
62
62
|Prevent/Detect|Investigate|Respond|
63
63
|---|---|---|
64
-
|Technologies include everything in EOP plus:<br><br>- Safe attachments<br>- Safe links Microsoft Defender for Collaboration protection for workloads (ex. SharePoint Online, Teams, OneDrive for Business)<br>- Time-of-click protection in email, Office clients, and Teams<br>- anti-phishing in Defender for Office 365<br>- User and domain impersonation protection<br>- Alerts, and SIEM integration API for alerts|SIEM integration API for detections<br>- **Real-time detections tool**<br>- URL trace<br>- Same
64
+
|Technologies include everything in EOP plus:<br><br>- Safe attachments<br>- Safe links Microsoft Defender for Office 365 protection for workloads (ex. SharePoint Online, Teams, OneDrive for Business)<br>- Time-of-click protection in email, Office clients, and Teams<br>- anti-phishing in Defender for Office 365<br>- User and domain impersonation protection<br>- Alerts, and SIEM integration API for alerts|SIEM integration API for detections<br>- **Real-time detections tool**<br>- URL trace<br>- Same
65
65
66
-
So, Microsoft Defender for Collaboration P1 expands on the ***prevention*** side of the house, and adds extra forms of ***detection***.
66
+
So, Microsoft Defender for Office 365 P1 expands on the ***prevention*** side of the house, and adds extra forms of ***detection***.
67
67
68
-
Microsoft Defender for Collaboration P1 also adds **Real-time detections** for investigations. This threat hunting tool's name is in bold, because having it is a clear means of *knowing* you have Defender for Collaboration P1. It doesn't appear in Defender for Collaboration P2.
68
+
Microsoft Defender for Office 365 P1 also adds **Real-time detections** for investigations. This threat hunting tool's name is in bold, because having it is a clear means of *knowing* you have Defender for Office 365 P1. It doesn't appear in Defender for Office 365 P2.
69
69
70
70
Gains with **Defender for Office 365, Plan 2** (to date):
71
71
<p>
72
72
73
73
|Prevent/Detect|Investigate|Respond|
74
74
|---|---|---|
75
-
|Technologies include everything in EOP, and Microsoft Defender for Collaboration P1 plus:<br><br>- Same|**Threat Explorer**<br>- Threat Trackers<br>- Campaign views|Automated Investigation and Response (AIR)<br>- AIR from Threat Explorer<br>- AIR for compromised users<br>- SIEM Integration API for Automated Investigations|
75
+
|Technologies include everything in EOP, and Microsoft Defender for Office 365 P1 plus:<br><br>- Same|**Threat Explorer**<br>- Threat Trackers<br>- Campaign views|Automated Investigation and Response (AIR)<br>- AIR from Threat Explorer<br>- AIR for compromised users<br>- SIEM Integration API for Automated Investigations|
76
76
77
-
So, Microsoft Defender for Collaboration P2 expands on the ***investigation and response*** side of the house, and adds a new hunting strength. Automation.
77
+
So, Microsoft Defender for Office 365 P2 expands on the ***investigation and response*** side of the house, and adds a new hunting strength. Automation.
78
78
79
-
In Microsoft Defender for Collaboration P2, the primary hunting tool is called **Threat Explorer** rather than Real-time detections. If you see Threat Explorer when you navigate to the Microsoft Defender portal, you're in Microsoft Defender for Collaboration P2.
79
+
In Microsoft Defender for Office 365 P2, the primary hunting tool is called **Threat Explorer** rather than Real-time detections. If you see Threat Explorer when you navigate to the Microsoft Defender portal, you're in Microsoft Defender for Office 365 P2.
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/design-solutions-secure-microsoft-365/includes/3-design-microsoft-defender-365-solution.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ Microsoft Defender XDR is a unified pre- and post-breach enterprise defense suit
3
3
Here's a list of the different Microsoft Defender XDR products and solutions that Microsoft Defender XDR coordinates with:
4
4
5
5
-[**Microsoft Defender for Endpoint**](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint)
6
-
-[**Microsoft Defender for Office 365**](/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview?view=o365-worldwide)
6
+
-[**Microsoft Defender for Office 365**](/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview)
7
7
-[**Microsoft Defender for Identity**](/defender-for-identity/what-is)
8
8
-[**Microsoft Defender for Cloud Apps**](/defender-cloud-apps/what-is-defender-for-cloud-apps)
@@ -17,7 +17,7 @@ Microsoft Defender XDR services protect:
17
17
18
18
-**Endpoints with Defender for Endpoint** - Defender for Endpoint is a unified endpoint platform for preventative protection, post-breach detection, automated investigation, and response.
19
19
-**Assets with Defender Vulnerability Management** - Microsoft Defender Vulnerability Management delivers continuous asset visibility, intelligent risk-based assessments, and built-in remediation tools to help your security and IT teams prioritize and address critical vulnerabilities and misconfigurations across your organization.
20
-
-**Email and collaboration with Defender for Office 365** - Defender for Collaboration safeguards your organization against malicious threats posed by email messages, links (URLs) and collaboration tools.
20
+
-**Email and collaboration with Defender for Office 365** - Defender for Office 365 safeguards your organization against malicious threats posed by email messages, links (URLs) and collaboration tools.
21
21
-**Identities with Defender for Identity and Microsoft Entra ID Protection** - Microsoft Defender for Identity is a cloud-based security solution that leverages your on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization. Microsoft Entra ID Protection uses the learnings Microsoft has acquired from their position in organizations with Microsoft Entra ID, the consumer space with Microsoft Accounts, and in gaming with Xbox to protect your users.
22
22
-**Applications with Microsoft Defender for Cloud Apps** - Microsoft Defender for Cloud Apps is a comprehensive cross-SaaS solution bringing deep visibility, strong data controls, and enhanced threat protection to your cloud apps.
23
23
@@ -27,7 +27,7 @@ Here's an example of how the Microsoft Defender portal correlates all related al
27
27
28
28
Here's an example of the list of related alerts for an incident.
29
29
30
-
:::image type="content" source="../media/incident-list.png" alt-text="Screenshot showint the list of alerts for an incident." border="true":::
30
+
:::image type="content" source="../media/incident-list.png" alt-text="Screenshot showing the list of alerts for an incident." border="true":::
31
31
32
32
Here's an example of query-based hunting on top of email and endpoint raw data.
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/design-solutions-secure-microsoft-365/includes/8-summary.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ You learned how to:
6
6
7
7
## Learn more with security documentation
8
8
9
-
-[Office 365 Security including Microsoft Defender for Collaboration and Exchange Online Protection - Office 365](/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview)
9
+
-[Office 365 Security including Microsoft Defender for Office 365 and Exchange Online Protection - Office 365](/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview)
10
10
-[Assess your security posture through Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score-improvement-actions)
11
11
-[Zero Trust deployment plan with Microsoft 365](/microsoft-365/security/microsoft-365-zero-trust)
0 commit comments