security copilot

23 Topics

Recordings | Security Community Webinars
https://youtu.be/PkdFIBvMVlw https://youtu.be/TmoS0tVwpAM See all of our recordings of past webinars here. To register for upcoming webinars visit aka.ms/SecurityCommunity.
Valon_Kolica
Jul 09, 2025 Place Microsoft Security Community Blog
99KViews
3likes
11Comments
Modern, unified data security in the AI era: New capabilities in Microsoft Purview
AI is transforming how organizations work—but it’s also changing how data moves, who can access it, and how easily it can be exposed. Sensitive data now appears in AI prompts, Copilot responses, and across a growing ecosystem of SaaS and GenAI tools. To keep up, organizations need data security that’s built for how people work with AI today. Microsoft Purview brings together native classification, visibility, protection and automated workflows across your data estate—all in one integrated platform. Today, we’re highlighting some of our new capabilities that help you: Uncover data blind spots: Discover hidden risks and improve data security posture and find sensitive data on endpoints with on-demand classification Strengthen protection across data flows: Enhance oversharing controls for Microsoft 365 Copilot, expand protection to more Azure data sources, and extend data security to the network layer Respond faster with automation: Automate investigation workflows with Alert agents in Data Loss Prevention (DLP) and Insider Risk Management (IRM) Discover hidden risks and improve data security posture Many security teams struggle with fragmented tools that siloes sensitive data visibility across apps and clouds. According to recent studies, 21% of decision-makers cite the lack of unified visibility as a top barrier to effective data security. This leads to gaps in protection and inefficient incident response—ultimately weakening the organization’s overall data security posture. To help organizations address these challenges, last November at Ignite we launched Microsoft Purview Data Security Posture Management (DSPM), and we’re excited to share that this capability is now available. DSPM continuously assesses your data estate, surfaces contextual insights into sensitive data and its usage, and recommends targeted controls to reduce risk and strengthen your data security program. We’re also bringing in new signals from email exfiltration and from user activity in the browser and network into DSPM’s insights and policy recommendations, making sure organizations can improve their protections and address potential data security gaps. You can now also experience deeper investigations into DSPM with 3x more suggested prompts, outcome-based promptbooks and new guidance experience that helps interpret unsupported user queries and offers helpful alternatives, increasing usability without hard stops. New Security Copilot task-based promptbooks in Purview DSPM Learn more about how DSPM can help your organization strengthen your data security posture. Find sensitive data on endpoints with on-demand classification Security teams often struggle to uncover sensitive data sitting for a long time on endpoints, one of the most overlooked and unmanaged surfaces in the data estate. Typically, data gets classified when a file is created, modified, or accessed. As a result, older data at rest that hasn’t been touched in a while can remain outside the scope of classification workflows. This lack of visibility increases the risk of exposure, especially for sensitive data that is not actively used or monitored. To tackle this challenge, we are introducing on-demand classification for endpoints. Coming to public preview in July, on-demand classification for endpoints gives security teams a targeted way to scan data at rest on Windows devices, without relying on file activity, to uncover sensitive files that have never been classified or reviewed. This means you can: Discover sensitive data on endpoints, including older, unclassified data that may never have been scanned, giving admins visibility into unclassified files that typically fall outside traditional classification workflows Support audit and compliance efforts by identifying sensitive data Focus scans on specific users, file types, or timelines to get visibility that really matters Get insights needed to prioritize remediation or protection strategies Security teams can define where or what to focus on by selecting specific users, file types, or last modified dates. This allows teams to prioritize scans for high-priority scenarios, like users handling sensitive data. Because on-demand classification scans are manually triggered and scoped without complex configuration, organizations can get targeted visibility into sensitive data on endpoints with minimal performance impact and without the need for complex setup. Complements just-in-time protection On-demand classification for endpoints also works hand-in-hand with existing endpoint DLP capabilities like just-in-time (JIT) protection. JIT protection kicks in during file access, blocking or alerting based on real-time content evaluation On-demand classification works ahead of time, identifying sensitive data that hasn’t been modified or accessed in an extended period Used together, they form a layered endpoint protection strategy, ensuring full visibility and protection. Choosing the right tool On-demand classification for endpoints is purpose-built for discovering sensitive data at rest on endpoints, especially files that haven’t been accessed or modified for a long time. It gives admins targeted visibility—no user action required. If you’re looking to apply labels, enforce protection policies, or scan files stored on on-premises servers, the Microsoft Purview Information Protection Scanner may be a better fit. It is designed for ongoing policy enforcement and label application across your hybrid environment. Learn more here. Get started with on-demand classification On-demand classification is easy to set up, with no agents to install or complex rules to configure. It only runs when you choose, rather than continuously running in the background. You stay in control of when and where scans happen, making it a simple and efficient way to extend visibility to endpoints. On-demand classification for endpoints enters public preview in July. Stay tuned for setup guidance and more details as we get closer to launch. Streamlining technical issue resolution with always-on diagnostics for endpoint devices Historically, resolving technical support tickets for Purview DLP required admins to manually collect logs and have end users reproduce the original issue at the time of the request. This could lead to delays, extended resolution times, and repeated communication cycles, especially for non-reproducible issues. Today, we’re introducing a new way to capture and share endpoint diagnostics: Always-on diagnostics available in public preview. When submitting support requests for Purview endpoint DLP, customers can now share rich diagnostic data with Microsoft without needing to recreate the issue scenario again at the time of submitting an investigation request such as a support ticket. This capability can now be enabled through your endpoint DLP settings. Learn more about always-on diagnostics here. Strengthening DLP for Microsoft 365 Copilot As organizations adopt Microsoft 365 Copilot, DLP plays a critical role in minimizing the risk of sensitive data exposure through AI. New enhancements give security teams greater control, visibility, and flexibility when protecting sensitive content in Copilot scenarios. Expanded protection to labeled emails DLP for Microsoft 365 Copilot now supports labeled email, available today, in addition to files in SharePoint and OneDrive. This helps prevent sensitive emails from being processed by Copilot and used as grounding data. This capability is applicable to emails sent after 1/1/2025. Alerts and investigations for Copilot access attempts Security teams can now configure DLP alerts for Microsoft 365 Copilot activity, surfacing attempts to access emails or files with sensitivity labels that match DLP policies. Alert reports include key details like user identity, policy match, and file name, enabling admins to quickly assess what happened, determine if further investigation is needed, and take appropriate follow-up actions. Admins can also choose to notify users directly, reinforcing responsible data use. The rollout will start on June 30 and is expected to be completed by the end of July. Simulation mode for Copilot DLP policies As part of the rollout starting on June 30, simulation mode lets admins test Copilot-specific DLP policies before enforcement. By previewing matches without impacting users, security teams can fine-tune rules, reduce false positives, and deploy policies with greater confidence. Learn more about DLP for Microsoft 365 Copilot here. Extended protection to more Azure data sources AI development is only as secure as the data that feeds it. That’s why Microsoft Purview Information Protection is expanding its auto-labeling capabilities to cover more Azure data sources. Now in public preview, security teams can automatically apply sensitivity labels to additional Azure data sources, including Azure Cosmos DB, PostgreSQL, KustoDB, MySQL, Azure Files, Azure Databricks, Azure SQL Managed Instances, and Azure Synapse. These additions build on existing coverage for Azure Blob Storage, Azure Data Lake Storage, and Azure SQL Database. These sources commonly fuel analytics pipelines and AI training workloads. With auto-labeling extended to more high-value data sources, sensitivity labels are applied to the data before it’s copied, shared, or integrated into downstream systems. These labels help enforce protection policies and limit unauthorized access to ensure sensitive data is handled appropriately across apps and AI workflows. Secure your AI training data, learn how to set up auto-labeling here. Extending data security to the network layer With more sensitive data moving through unmanaged SaaS apps and personal AI tools, your network is now a critical security surface. Earlier this year, we announced the introduction of Purview data security controls for the network layer. With inline data discovery for the network, organizations can detect sensitive data that’s outside of the trusted boundaries of the organization, such as unmanaged SaaS apps and cloud services. This helps admins understand how sensitive data can be intentionally or inadvertently exfiltrated to personal instances of apps, unsanctioned GenAI apps, cloud storage boxes, and more. This capability is now available in public preview — learn more here. Visibility of sensitive data sent through the network also includes insights into how users may be sharing data in risky ways. User activities such as file uploads or AI prompt submissions are captured in Insider Risk Management to formulate richer and comprehensive profiles of user risk. In turn, these signals will also better contextualize future data interactions and enrich policy verdicts. These user risk indicators will become available in the coming weeks. Automate investigation workflows with Alert Triage Agents in DLP and IRM Security teams today face a high volume of alerts, often spending hours sorting through false positives and low priority flags to find threats that matter. To help security teams focus on what’s truly high risk, we’re excited to share that the Alert Triage Agents in Microsoft Purview Data Loss Prevention (DLP) and Insider Risk Management (IRM) are now available in public preview. These autonomous, Security Copilot-powered agents prioritize alerts that pose the greatest risk to organizations. Whether it’s identifying high-impact exfiltration attempts in DLP or surfacing potential insider threats in IRM, the agents analyze both content and intent to deliver transparent, explainable findings. Built to learn and improve from user feedback, these agents not only accelerate investigations, but also improve over time, empowering teams to prioritize real threats, reduce time spent on false positives, and adapt to evolving risks through feedback. Watch the new Mechanics video, or learn more about how to get started here. A unified approach to modern data security Disjointed security tools create gaps and increase operational overhead. Microsoft Purview offers a unified data security platform designed to keep pace with how your organization works with AI today. From endpoints visibility to automated security workflows, Purview unifies data security across your estate, giving you one platform for end-to-end data security. As your data estate grows and AI reshapes the way you work, Purview helps you stay ahead—so you can scale securely, reduce risk, and unlock the full productivity potential of AI with confidence. Ready to unify your data security into one integrated platform? Try Microsoft Purview free for 90 days.
chmcconnell
Jun 26, 2025 Place Microsoft Security Community Blog
617Views
2likes
0Comments
How to build the Microsoft Purview extended report experience
This is a step-by-step guided walkthrough of the extended report experience.
Jon_Nordstrom
Jun 24, 2025 Place Microsoft Security Community Blog
11KViews
3likes
9Comments
eDiscovery launches a modern, intuitive user experience
Announcing a new, intuitive, unified user experience for eDiscovery.
ninachen
Jun 04, 2025 Place Microsoft Security Community Blog
10KViews
6likes
7Comments
“Build Your Own” M365 Copilot DPIA templates for public sector and enterprise organizations
In April, Microsoft launched our “Build Your Own” Data Protection Impact Assessment templates for Office 365 as part of our commitment to helping our customers embrace new cutting-edge technologies while providing the information they need to continue to meet their compliance obligations. Today, we’re excited to expand that commitment into the era of AI, as we share our new “Build Your Own” Data Protection Impact Assessment templates for Microsoft’s AI-powered productivity service, Microsoft 365 Copilot. These “Build Your Own” DPIAs—for both public sector and enterprise customers—are customizable and illustrative template guides that Microsoft has produced, with references to our Product Terms, Data Protection Addendum (“DPA”), and Microsoft’s extensive documentation for M365 Copilot. They are designed to help public sector organizations systematically identify, assess, and address potential data protection risks, making it easier to evaluate compliance with the GDPR. As AI technologies rapidly evolve, and uses of that technology with it, we recognize that compliance tools like the “Build Your Own” DPIA will need to evolve, too. As such, we are committed to continually refining and improving the document, including based on customer feedback, with the goal of helping make our customers’ AI transformation compliance journey as friction-free as possible. Download the templates here: “Build Your Own” M365 Copilot Data Protection Impact Assessment for the Public Sector “Build Your Own” M365 Copilot Data Protection Impact Assessment for Enterprise Customers
MannySahota
Jun 02, 2025 Place Microsoft Security Community Blog
1.3KViews
0likes
0Comments
Rethinking Data Security and Governance in the Era of AI
The era of AI is reshaping industries, enabling unprecedented innovations, and presenting new opportunities for organizations worldwide. But as organizations accelerate AI adoption, many are focused on a growing concern: their current data security and governance practices are not effectively built for the fast-paced AI innovation and ever-evolving regulatory landscape. At Microsoft, we recognize the critical need for an integrated approach to address these risks. In our latest findings, Top 3 Challenges in Securing and Governing Data for the Era of AI, we uncovered critical gaps in how organizations manage data risk. The findings exemplify the current challenges: 91% of leaders are not prepared to manage risks posed by AI 1 and 85% feel unprepared to comply with AI regulations 2 . These gaps not only increase non-compliance but also put innovation at risk. Microsoft Purview has the tools to tackle these challenges head on, helping organizations move to an approach that protects data, meets compliance regulations, and enables trusted AI transformation. We invite you to take this opportunity to evaluate your current practices, platforms, and responsibilities, and to understand how to best secure and govern your organization for growing data risks in the era of AI. Platform fragmentation continues to weaken security outcomes Organizations often rely on fragmented tools across security, compliance, and data teams, leading to a lack of unified visibility and insufficient data hygiene. Our findings reveal the effects of fragmented platforms, leading to duplicated data, inconsistent classification, redundant alerts, and siloed investigations, which ultimately is causing data exposure incidents related to AI to be on the rise 3 . Microsoft Purview offers centralized visibility across your organization’s data estate. This allows teams to break down silos, streamline workflows, and mitigate data leakage and oversharing. With Microsoft Purview, capabilities like data health management and data security posture management are designed to enhance collaboration and deliver enriched insights across your organization to help further protect your data and mitigate risks faster. Microsoft Purview offers the following: Unified insights across your data estate, breaking down silos between security, compliance, and data teams. Microsoft Purview Data Security Posture Management (DSPM) for AI helps organizations gain unified visibility into GenAI usage across users, data, and apps to address the heightened risk of sensitive data exposure from AI. Built-in capabilities like classification, labeling, data loss prevention, and insider risk insights in one platform. In addition, newly launched solutions like Microsoft Purview Data Security Investigations accelerate investigations with AI-powered deep content analysis, which helps data security teams quickly identify and mitigate sensitive data and security risks within impacted data. Organizations like Kern County historically relied on many fragmented systems but adopted Microsoft Purview to unify their organization’s approach to data protection in preparation for increasing risks associated with deploying GenAI. “We have reduced risk exposure, [Microsoft] Purview helped us go from reaction to readiness. We are catching issues proactively instead of retroactively scrambling to contain them.” – Aaron Nance, Deputy Chief Information Security Officer, Kern County Evolving regulations require continuous compliance AI-driven innovation is creating a surge in regulations, resulting in over 200 daily updates across more than 900 regulatory agencies 4 , as highlighted in our research. Compliance has become increasingly difficult, with organizations struggling to avoid fines and comply with varying requirements across regions. To navigate these challenges effectively, security leaders’ responsibilities are expanding to include oversight across governance and compliance, including oversight of traditional data catalog and governance solutions led by the central data office. Leaders also cite the need for regulation and audit readiness. Microsoft Purview enables compliance and governance by: Streamlining compliance with Microsoft Purview Compliance Manager templates, step-by-step guidance, and insights for region and industry-specific regulations, including GDPR, HIPAA, and AI-specific regulation like the EU AI Act. Supporting legal matters such as forensic and internal investigations with audit trail records in Microsoft Purview eDiscovery and Audit. Activating and governing data for trustworthy analytics and AI with Microsoft Purview Unified Catalog, which enables visibility across your data estate and data confidence via data quality, data lineage, and curation capabilities for federated governance. Microsoft Purview’s suite of capabilities provides visibility and accountability, enabling security leaders to meet stringent compliance demands while advancing AI initiatives with confidence. Organizations need a unified approach to secure and govern data Organizations are calling for an integrated platform to address data security, governance, and compliance collectively. Our research shows that 95% of leaders agree that unifying teams and tools is a top priority 5 and 90% plan to adopt a unified solution to mitigate data related risks and maximize impact 6 . Integration isn't just about convenience, it’s about enabling innovation with trusted data protection. Microsoft Purview enables a shared responsibility model, allowing individual business units to own their data while giving central teams oversight and policy control. As organizations adopt a unified platform approach, our findings reveal the upside potential not only being reduced risk but also cost savings. With AI-powered copilots such as Security Copilot in Microsoft Purview, data protection tasks are simplified with natural-language guidance, especially for under resourced teams. Accelerating AI transformation with Microsoft Purview Microsoft Purview helps security, compliance, and governance teams navigate the complexities of AI innovation while implementing effective data protection and governance strategies. Microsoft partner EY highlights the results they are seeing: “We are seeing 25%–30% time savings when we build secure features using [Microsoft] Purview SDK. What was once fragmented is now centralized. With [Microsoft] Purview, everything comes together on one platform, giving a unified foundation to innovate and move forward with confidence.” – Prashant Garg, Partner of Data and AI, EY We invite you to explore how you can propel your organization toward a more secure future by reading the full research paper at https://aka.ms/SecureAndGovernPaper. Visit our website to learn more about Microsoft Purview. 1 Forbes, Only 9% Of Surveyed Companies Are Ready To Manage Risks Posed By AI, 2023 2 SAP LeanIX, AI Survey Results, 2024 3 Microsoft, Data Security Index Report, 2024 4 Forbes, Cost of Compliance, Thomson Reuters, 2021 5 Microsoft, Audience Research, 2024 6 Microsoft, Customer Requirements Research, 2024
AnjaleePatel
May 27, 2025 Place Microsoft Security Community Blog
1.2KViews
1like
0Comments
Enterprise-grade controls for AI apps and agents built with Azure AI Foundry and Copilot Studio
AI innovation is moving faster than ever, and more AI projects are moving beyond experimentation into deployment, to drive tangible business impact. As organizations accelerate innovation with custom AI applications and agents, new risks emerge across the software development lifecycle and AI stack related to data oversharing and leaks, new vulnerabilities and threats, and non-compliance with stringent regulatory requirements Through 2025, poisoning of software supply chains and infrastructure technology stacks will constitute more than 70% of malicious attacks against AI used in the enterprise 1 , highlighting potential threats that originate early in development. Today, the average cost of a data breach is $4.88 million, but when security issues are caught early in the development process, that number drops dramatically to just $80 per incident 2 . The message is very clear; security can’t be an afterthought anymore. It must be a team sport across the organization, embedded from the start and throughout the development lifecycle. That's why developers and security teams should align on processes and tools that bring security into every stage of the AI development lifecycle and give security practitioners visibility into and the ability to mitigate risks. To address these growing challenges and help customers secure and govern their AI workloads across development and security teams, we are: Enabling Azure AI Foundry and Microsoft Copilot Studio to provide best-in-class foundational capabilities to secure and govern AI workloads Deeply integrating and embedding industry-leading capabilities from Microsoft Purview, Microsoft Defender, and Microsoft Entra into Azure AI Foundry and Microsoft Copilot Studio This week, 3,000 developers are gathering in Seattle for the annual Microsoft Build conference, with many more tuning in online, to learn practical skills for accelerating their AI apps and agents' innovation. To support their AI innovation journey, today we are excited to announce several new capabilities to help developers and organizations secure and govern AI apps and agents. New Azure AI Foundry foundational capabilities to secure and govern AI workloads Azure AI Foundry enhancements for AI security and safety With 70,000 customers, 100 trillion tokens processed this quarter, and 2 billion enterprise search queries each day, Azure AI Foundry has grown beyond just an application layer—it's now a comprehensive platform for building agents that can plan, take action, and continuously learn to drive real business outcomes. To help organizations build and deploy AI with confidence, we’re introducing new security and safety capabilities and insights for developers in Azure AI Foundry Introducing Spotlighting to detect and block prompt injection attacks in real time As AI systems increasingly rely on external data sources, a new class of threats has emerged. Indirect prompt injection attacks embed hidden instructions in documents, emails, and web content, tricking models into taking unauthorized actions without any direct user input. These attacks are difficult to detect and hard to prevent using traditional filters alone. To address this, Azure AI Content Safety is introducing Spotlighting, now available in preview. Spotlighting strengthens the Prompt Shields guardrail by improving its ability to detect and handle potential indirect prompt injections, where hidden adversarial instructions are embedded in external content. This new capability helps prevent the model from inadvertently acting on malicious prompts that are not directly visible to the user. Enable Spotlighting in Azure AI Content Safety to detect potential indirect prompt injection attacks New capabilities for task adherence evaluation and task adherence mitigation to ensure agents remain within scope As developers build more capable agents, organizations face growing pressure to help confirm those agents act within defined instructions and policy boundaries. Even small deviations can lead to tool misuse, broken workflows, or risks like unintended exposure of sensitive data. To solve this, Azure AI Foundry now includes task adherence for agents, now in preview and powered by two components: a real-time evaluation and a new control within Azure AI Content Safety. At the core is a real-time task adherence evaluation API, part of Azure AI Content Safety. This API assesses whether an agent’s behavior is aligned with its assigned task by analyzing the user’s query, system instructions, planned tool calls, and the agent’s response. The evaluation framework is built on Microsoft’s Agent Evaluators, which measure intent resolution, tool selection accuracy, completeness of response, and overall alignment to the original request. Developers can run this scoring logic locally using the Task Adherence Evaluator in the Azure AI Evaluation SDK, with a five-point scale that ranges from fully nonadherent to fully adherent. This gives teams a flexible and transparent way to inspect task-level behavior before it causes downstream issues. Task adherence is enforced through a new control in Azure AI Content Safety. If an agent goes off-task, the control can block tool use, pause execution, or trigger human review. In Azure AI Agent Service, it is available as an opt-in feature and runs automatically. Combined with real-time evaluation, this control helps to ensure that agents stay on task, follow instructions, and operate according to enterprise policies. Learn more about Prompt Shields in Azure AI Content Safety. Azure AI Foundry continuous evaluation and monitoring of agentic systems Maintaining high performance and compliance for AI agents after deployment is a growing challenge. Without ongoing oversight, issues like performance degradation, safety risks, or unintentional misuse of resources can slip through unnoticed. To address this, Azure AI Foundry introduces continuous evaluation and monitoring of agentic systems, now in preview, provides a single pane of glass dashboard to track key metrics such as performance, quality, safety, and resource usage in real time. Continuous evaluation runs quality and safety evaluations at a sampled rate of production usage with results made available in the Azure AI Foundry Monitoring dashboard and published to Application Insights. Developers can set alerts to detect drift or regressions and use Azure Monitor to gain full-stack visibility into their AI systems. For example, an organization using an AI agent to assist with customer-facing tasks can monitor groundedness and detect a decline in quality when the agent begins referencing irrelevant information, helping teams to act before it potentially negatively affects trust of users. Azure AI Foundry evaluation integrations with Microsoft Purview Compliance Manager, Credo AI, and Saidot for streamlined compliance AI regulations and standards introduce new requirements for transparency, documentation, and risk management for high-risk AI systems. As developers build AI applications and agents, they may need guidance and tools to help them evaluate risks based on these requirements and seamlessly share control and evaluation insights with compliance and risk teams. Today, we are announcing previews for Azure AI Foundry evaluation tool’s integration with a compliance management solution, Microsoft Purview Compliance Manager, and AI governance solutions, Credo AI and Saidot. These integrations help define risk parameters, run suggested compliance evaluations, and collect evidence for control testing and auditing. For example, for a developer who’s building an AI agent in Europe may be required by their compliance team to complete a Data Protection Impact Assets (DPIA) and Algorithmic Impact Assessment (AIA) to meet internal risk management and technical documentation requirements aligned with emerging AI governance standards and best practices. Based on Purview Compliance Manager’s step-by-step guidance on controls implementation and testing, the compliance teams can evaluate risks such as potential bias, cybersecurity vulnerabilities, or lack of transparency in model behavior. Once the evaluation is conducted in Azure AI Foundry, the developer can obtain a report with documented risk, mitigation, and residual risk for compliance teams to upload to Compliance Manager to support audits and provide evidence to regulators or external stakeholders. Assess controls for Azure AI Foundry against emerging AI governance standards Learn more about Purview Compliance Manager. Learn more about the integration with Credo AI and Saidot in this blogpost. Leading Microsoft Entra, Defender and Purview value extended to Azure AI Foundry and Microsoft Copilot Studio Introducing Microsoft Entra Agent ID to help address agent sprawl and manage agent identity Organizations are rapidly building their own AI agents, leading to agent sprawl and a lack of centralized visibility and management. Security teams often struggle to keep up, unable to see which agents exist and whether they introduce security or compliance risks. Without proper oversight, agent sprawl increases the attack surface and makes it harder to manage these non-human identities. To address this challenge, we’re announcing the public preview of Microsoft Entra Agent ID, a new capability in the Microsoft Entra admin center that gives security admins visibility and control over AI agents built with Copilot Studio and Azure AI Foundry. With Microsoft Entra Agent ID, an agent created through Copilot Studio or Azure AI Foundry is automatically assigned an identity with no additional work required from the developers building them. This is the first step in a broader initiative to manage and protect non-human identities as organizations continue to build AI agents. : Security and identity admins can gain visibility into AI agents built in Copilot Studio and Azure AI Foundry in the Microsoft Entra Admin Center This new capability lays the foundation for more advanced capabilities coming soon to Microsoft Entra. We also know that no one can do it alone. Security has always been a team sport, and that’s especially true as we enter this new era of protecting AI agents and their identities. We’re energized by the momentum across the industry; two weeks ago, we announced support for the Agent-to-Agent (A2A) protocol and began collaborating with partners to shape the future of AI identity workflows. Today, we’re also excited to announce new partnerships with ServiceNow and Workday. As part of this, we’ll integrate Microsoft Entra Agent ID with the ServiceNow AI Platform and the Workday Agent System of Record. This will allow for automated provisioning of identities for future digital employees. Learn more about Microsoft Entra Agent ID. Microsoft Defender security alerts and recommendations now available in Azure AI Foundry As more AI applications are deployed to production, organizations need to predict and prevent potential AI threats with natively integrated security controls backed by industry-leading Gen AI and threat intelligence for AI deployments. Developers need critical signals from security teams to effectively mitigate security risks related to their AI deployments. When these critical signals live in separate systems outside the developer experience, this can create delays in mitigation, leaving opportunities for AI apps and agents to become liabilities and exposing organizations to various threats and compliance violations. Now in preview, Microsoft Defender for Cloud integrates AI security posture management recommendations and runtime threat protection alerts directly into the Azure AI Foundry portal. These capabilities, previously announced as part of the broader Microsoft Defender for Cloud solution, are extended natively into Azure AI Foundry enabling developers to access alerts and recommendations without leaving their workflows. This provides real-time visibility into security risks, misconfigurations, and active threats targeting their AI applications on specific Azure AI projects, without needing to switch tools or wait on security teams to provide details. Security insights from Microsoft Defender for Cloud help developers identify and respond to threats like jailbreak attacks, sensitive data leakage, and misuse of system resources. These insights include: AI security posture recommendations that identify misconfigurations and vulnerabilities in AI services and provide best practices to reduce risk Threat protection alerts for AI services that notify developers of active threats and provide guidance for mitigation, across more than 15 detection types For example, a developer building an AI-powered agent can receive security recommendations suggesting the use of Azure Private Link for Azure AI Services resources. This reduces the risk of data leakage by handling the connectivity between consumers and services over the Azure backbone network. Each recommendation includes actionable remediation steps, helping teams identify and mitigate risks in both pre- and post-deployment phases. This helps to reduce risks without slowing down innovation. : Developers can view security alerts on the Risks + alerts page in Azure AI Foundry : Developers can view recommendations on the Guardrails + controls page in Azure AI Foundry This integration is currently in preview and will be generally available in June 2025 in Azure AI Foundry. Learn more about protecting AI services with Microsoft Defender for Cloud. Microsoft Purview capabilities extended to secure and govern data in custom-built AI apps and agents Data oversharing and leakage are among the top concerns for AI adoption, and central to many regulatory requirements. For organizations to confidently deploy AI applications and agents, both low code and pro code developers need a seamless way to embed security and compliance controls into their AI creations. Without simple, developer-friendly solutions, security gaps can quickly become blockers, delaying deployment and increasing risks as applications move from development to production. Today, Purview is extending its enterprise-grade data security and compliance capabilities, making it easier for both low code and pro code developers to integrate data security and compliance into their AI applications and agents, regardless of which tools or platforms they use. For example, with this update, Microsoft Purview DSPM for AI becomes the one place data security teams can see all the data risk insights across Microsoft Copilots, agents built in Agent Builder and Copilot Studio, and custom AI apps and agents built in Azure AI Foundry and other platforms. Admins can easily drill into security and compliance insights for specific AI apps or agents, making it easier to investigate and take action on potential risks. : Data security admins can now find data security and compliance insights across Microsoft Copilots, agents built with Agent Builder and Copilot Studio, and custom AI apps and agents in Microsoft Purview DSPM for AI In the following sections, we will provide more details about the updates to Purview capabilities in various AI workloads. 1. Microsoft Purview data security and compliance controls can be extended to any custom-built AI application and agent via the new Purview SDK or the native Purview integration with Azure AI Foundry. The new capabilities make it easy and effortless for security teams to bring the same enterprise-grade data security compliance controls available today for Microsoft 365 Copilot to custom AI applications and agents, so organizations can: Discover data security risks, such as sensitive data in user prompts, and data compliance risks, such as harmful content, and get recommended actions to mitigate risks proactively in Microsoft Purview Data Security Posture Management (DSPM) for AI. Protect sensitive data against data leakage and insider risks with Microsoft Purview data security policies. Govern AI interactions with Audit, Data Lifecycle Management, eDiscovery, and Communication Compliance. Microsoft Purview SDK Microsoft Purview now offers Purview SDK, a set of REST APIs, documentation, and code samples, currently in preview, enabling developers to integrate Purview's data security and compliance capabilities into AI applications or agents within any integrated development environment (IDE). : By embedding Purview APIs into the IDE, developers help enable their AI apps to be secured and governed at runtime For example, a developer building an AI agent using an AWS model can use the Purview SDK to enable their AI app to automatically identify and block sensitive data entered by users before it’s exposed to the model, while also providing security teams with valuable signals that support compliance. With Purview SDK, startups, ISVs, and partners can now embed Purview industry-leading capabilities directly into their AI software solutions, making these solutions Purview aware and easier for their customers to secure and govern data in their AI solutions. For example, Infosys Vice President and Delivery Head of Cyber Security Practice, Ashish Adhvaryu indicates, “Infosys Cyber Next platform integrates Microsoft Purview to provide enhanced AI security capabilities. Our solution, the Cyber Next AI assistant (Cyber Advisor) for the SOC analyst, leverages Purview SDK to drive proactive threat mitigation with real-time monitoring and auditing capabilities. This integration provides holistic AI-assisted protection, enhancing cybersecurity posture." Microsoft partner EY (previously known as Ernst and Young) has also leveraged the new Purview SDK to embed Purview value into their GenAI initiatives. “We’re not just building AI tools, we are creating Agentic solutions where trust, security, and transparency are present from the start, supported by the policy controls provided through the Purview SDK. We’re seeing 25 to 30 percent time savings when we build secure features using the Purview SDK,” noted Sumanta Kar, Partner, Innovation and Emerging Tech at EY. Learn more about the Purview SDK. Microsoft Purview integrates natively with Azure AI Foundry Organizations are developing an average of 14 custom AI applications. The rapid pace of AI innovation may leave security teams unaware of potential data security and compliance risks within their environments. With the update announced today, Azure AI Foundry signals are now directly integrated with Purview Data Security Posture Management for AI, Insider Risk Management, and data compliance controls, minimizing the need for additional development work. For example, for AI applications and agents built with Azure AI Foundry models, data security teams can gain visibility into AI usage and data risks in Purview DSPM for AI, with no additional work from developers. Data security teams can also detect, investigate, and respond to both malicious and inadvertent user activities, such as a departing employee leveraging an AI agent to retrieve an anomalous amount of sensitive data, with Microsoft Purview Insider Risk Management (IRM) policies. Lastly, user prompts and AI responses in Azure AI apps and agents can now be ingested into Purview compliance tools as mentioned above. Learn more about Microsoft Purview for Azure AI Foundry. 2. Purview data protections extended to Copilot Studio agents grounded in Microsoft Dataverse data Coming to preview in June, Purview Information Protection extends auto-labeling and label inheritance coverage to Dataverse to help prevent oversharing and data leaks. Information Protection makes it easier for organizations to automatically classify and protect sensitive data at scale. A common challenge is that sensitive data often lands in Dataverse from various sources without consistent labeling or protection. The rapid adoption of agents built using Copilot Studio and grounding data from Dataverse increases the risk of data oversharing and leakage if data is not properly protected. With auto-labeling, data stored in Dataverse tables can be automatically labeled based on policies set in Microsoft Purview, regardless of its source. This reduces the need for manual labeling effort and protects sensitive information from the moment it enters Dataverse. With label inheritance, AI agent responses grounded in Dataverse data will automatically carry and honor the source data’s sensitivity label. If a response pulls from multiple tables with different labels, the most restrictive label is applied to ensure consistent protection. For example, a financial advisor building an agent in Copilot Studio might connect multiple Dataverse tables, some labeled as “General” and others as “Highly Confidential.” If a response pulls from both, it will inherit the most restrictive label, in this case, "Highly Confidential,” to prevent unauthorized access and ensure appropriate protections are applied across both maker and users of the agent. Together, auto-labeling and label inheritance in Dataverse support a more secure, automated foundation for AI. : Sensitivity labels will be automatically applied to data in Dataverse : AI-generated responses will inherit and honor the source data’s sensitivity labels Learn more about protecting Dataverse data with Microsoft Purview. 3. Purview DSPM for AI can now provide visibility into unauthenticated interactions with Copilot Studio agents As organizations increasingly use Microsoft Copilot Studio to deploy AI agents for frontline customer interactions, gaining visibility into unauthenticated user interactions and proactively mitigating risks becomes increasingly critical. Building on existing Purview and Copilot Studio integrations, we’ve extended DSPM for AI and Audit in Copilot Studio to provide visibility into unauthenticated interactions, now in preview. This gives organizations a more comprehensive view of AI-related data security risks across authenticated and unauthenticated users. For example, a healthcare provider hosting an external, customer-facing agent assistant must be able to detect and respond to attempts by unauthenticated users to access sensitive patient data. With these new capabilities in DSPM for AI, data security teams can now identify these interactions, assess potential exposure of sensitive data, and act accordingly. Additionally, integration with Purview Audit provides teams with seamless access to information needed for audit requirements. : Gain visibility into all AI interactions, including those from unauthenticated users Learn more about Purview for Copilot Studio. 4. Purview Data Loss Prevention extended to more Microsoft 365 agent scenarios To help organizations prevent data oversharing through AI, at Ignite 2024, we announced that data security admins could prevent Microsoft 365 Copilot from using certain labeled documents as grounding data to generate summaries or responses. Now in preview, this control also extends to agents published in Microsoft 365 Copilot that are grounded by Microsoft 365 data, including pre-built Microsoft 365 agents, agents built with the Agent Builder, and agents built with Copilot Studio. This helps ensure that files containing sensitive content are used appropriately by AI agents. For example, confidential legal documents with highly specific language that could lead to improper guidance if summarized by an AI agent, or "Internal only” documents that shouldn’t be used to generate content that can be shared outside of the organization. : Extend data loss prevention (DLP) policies to Microsoft 365 Copilot agents to protect sensitive data Learn more about Data Loss Prevention for Microsoft 365 Copilot and agents. The data protection capabilities we are extending to agents in Agent Builder and Copilot Studio demonstrate our continued investment in strengthening the Security and Governance pillar of the Copilot Control System (CSS). CCS provides integrated controls to help IT and security teams secure, manage, and monitor Copilot and agents across Microsoft 365, spanning governance, management, and reporting. Learn more here. Explore additional resources As developers and security teams continue to secure AI throughout its lifecycle, it’s important to stay ahead of emerging risks and ensure protection. Microsoft Security provides a range of tools and resources to help you proactively secure AI models, apps, and agents from code to runtime. Explore the following resources to deepen your understanding and strengthen your approach to AI security: Learn more about Security for AI solutions on our webpage  Learn more about Microsoft Purview SDK Get started with Azure AI Foundry Get started with Microsoft Entra Get started with Microsoft Purview  Get started with Microsoft Defender for Cloud  Get started with Microsoft 365 Copilot Get started with Copilot Studio Sign up for a free Microsoft 365 E5 Security Trial and Microsoft Purview Trial  1 Predicts 2025: Navigating Imminent AI Turbulence for Cybersecurity, Jeremy D'Hoinne, Akif Khan, Manuel Acosta, Avivah Litan, Deepak Seth, Bart Willemsen, 10 February 2025 2 IBM. "Cost of a Data Breach 2024: Financial Industry." IBM Think, 13 Aug. 2024, https://www.ibm.com/think/insights/cost-of-a-data-breach-2024-financial-industry; Cser, Tamas. "The Cost of Finding Bugs Later in the SDLC." Functionize, 5 Jan. 2023, https://www.functionize.com/blog/the-cost-of-finding-bugs-later-in-the-sdlc
LouAdesida
May 21, 2025 Place Microsoft Security Community Blog
6.5KViews
1like
0Comments
Blog Series: Charting Your Path to Cyber Resiliency
"Cyber resilience is more than just a buzzword in the security industry; it is an essential approach to safeguarding digital assets in an era where cyber threats are not a matter of ‘if’ but ‘when’." - World Economic Forum, 2024 Cyber resiliency describes an organization’s ability to anticipate, withstand, respond and recover from adverse conditions caused by cyberattacks. Destructive cyberattacks such as ransomware can be highly impactful to business operations and profitability. With its emphasis on protecting our companies’ most critical business functions, cyber resiliency enhances the reputation of the Cybersecurity function - it can even help us achieve that most elusive goal of demonstrating our value to the business. In Part 1 and Part 2 of this series we examined the origins of cyber resiliency and Microsoft’s approach to helping our clients become more cyber resilient. As we learned in Part 1, Microsoft has identified 24 key issues that organizations should strategically target to enhance their cyber resilience. These key issues are grouped into the following categories: Low maturity security operations Insecure configuration of identity provider Insufficient privilege access and lateral movement controls No Multi-factor Authentication Lack of information protection control Limited adoption of modern security frameworks Let’s look at how Security Copilot can help, starting with the issue of Low maturity security operations. Security Operations Since its official release in April 2024, we’ve seen many Microsoft clients benefit from Security Copilot’s capabilities to address cyber resiliency issues in the category of Low maturity SOC Operations. For example, through its built-in integration with the Microsoft Defender XDR suite, Security Copilot features such as incident summaries, KQL Query Assistant and guided response can help with these components of the control: Skill gaps across security operations Limited use of endpoint detection and response Gaps in security monitoring and integration Even customers choosing not to use the full Defender XDR suite also benefit from Copilot’s abilities to help them reverse engineer malware and generate scripts. And organizations with limited or no SIEM/SOAR capabilities can also take advantage of Security Copilot’s easy integration with Microsoft Sentinel to accelerate SIEM/SOAR adoption. Security Copilot also assists with the issue of Ineffective SOC processes and operating model in 2 key ways: Reporting and Threat Intelligence. Reporting Security Copilot customers love the tool’s ability to quickly generate comprehensive incident reports geared to a variety of audiences, both technical and executive. Microsoft Defender for Threat Intelligence Integration Cyber Threat Intelligence (CTI) plays an important role in cyber resilience. NIST notes that an organization’s cyber resiliency decreases as the threat environment changes and new threat actors, techniques and vulnerabilities are introduced. Yet we often see customers not using threat intelligence effectively or worse, not using it at all. Within the M365 Portal, the embedded Security Copilot experience features incident summaries that are automatically enriched with threat intelligence from the full version of Microsoft Defender for Threat Intelligence. In both the embedded and standalone experiences, Security Copilot enables SOC analysts to use natural language to learn more about the threats and threat actors affecting their company and industry, get information about specific IOCs, and perform vulnerability impact assessments. Not sure how to start using threat intelligence? That’s OK, Security Copilot’s got you covered with suggested prompts like these in the standalone portal: Keep in mind, though, that Security Copilot is not just for SOC Operations– in fact, one of the key mistakes we’ve seen customers make in Security Copilot proof-of-concepts has been in failing to involve Security teams outside the SOC. Simply put, if your organization is just using Security Copilot in the SOC, you’re significantly limiting its impact on your overall cyber resilience. So let’s look next at what else it can do through integrations with identity management, data protection, and cloud platforms. Identity Management According to the Verizon Data Breach Investigations Report (DBIR), most breaches start with stolen credentials. This is reflected in Microsoft’s cyber resilience guidance where 3 of the key issue categories are identity-based. Security Copilot aids with identifying gaps in Entra configuration, both in the Entra Admin center and the Security Copilot standalone experience. Core capabilities include: Troubleshooting a user’s sign-in failures Providing user account details and authentication methods Exploring audit log events for a particular user, group, or application Enumerating Entra ID roles and group memberships In this case I’m troubleshooting a recent failed sign on attempt by a user. Security Copilot gives me the details of the sign-in and tells me in plain language the reason for the failure, along with the applicable conditional access policy, and the remediation steps to take: Security and Identity pros whose organizations already use Microsoft’s Workload Identities feature can also take advantage of Security Copilot’s abilities to investigate risky Entra ID applications. Security Copilot’s reach even extends to protection of Active Directory on-premises through its integration with Microsoft's Unified Security Operations Platform, which can include Defender for Identity alerts, as well as Windows Security Events collected by Microsoft Sentinel. Data Protection and Vulnerability Management The cyber resilience category Lack of Information Control covers a diverse set of components, including ineffective data loss prevention controls and lack of patch and vulnerability management. Security Copilot integrations support various teams across the organization in areas such as: Data Protection Security Copilot has a powerful integration with Microsoft Purview Data Security Posture Management (DSPM), a centralized data security management tool that includes signals from Microsoft Purview Information Protection, Data Loss Prevention, and Insider Risk Management. Just some of the many goals of this integration are: Helping Security teams conduct deeper investigations into data security incidents Enabling DLP admins to better identify gaps in DLP policy coverage Identifying devices involved in data exfiltration activities Assisting with insider risk management investigations Vulnerability Management As SANS notes, “The quantity of outstanding vulnerabilities for most large organizations is overwhelming, and all organizations struggle to keep up with the never-ending onslaught of new vulnerabilities in their infrastructure and applications.” Security Copilot works with Microsoft Defender External Attack Surface Management (Defender EASM) to help address this challenge. Defender EASM helps identify public-facing assets such as domains and hosts to map your organization’s external attack surface, discover unknown issues, and minimize risk. Security Copilot’s integration with EASM helps teams identify public-facing assets with high-priority CVEs and CVSS scores and find issues like expired domains, expired SSL certificates and SHA1 certificates. If you’re not currently using Defender EASM, it offers a free 30-day trial. (In fact, many customers have been so impressed with EASM and its Security Copilot integration during their trials, they’ve gone ahead and made it a permanent part of their cyber resilience strategy). Finally, note that both Purview DSPM and Defender EASM have multi-cloud capabilities. When used in combination with Security Copilot, they can greatly assist IT and Security teams with limited security experience in more than 1 cloud. Cloud Platforms Finally, in the cyber resilience category Limited adoption of modern security frameworks, Security Copilot helps address the issue of insecure design and configuration across cloud platforms via integrations with Azure Firewall and Azure WAF. Security Copilot features include identifying malicious traffic, searching for a given IDPS signature across all Azure Firewalls in the environment, and generating recommendations to improve the overall security of your deployments. Security Copilot can also help analyze Azure Web Application Firewall (WAF) logs to provide context for: Most frequently triggered rules Malicious IP addresses identified Blocked SQL injection (SQLi) and Cross-site Scripting (XSS) requests Microsoft Copilot for Security integration is available for both Azure WAF on both Azure Application Gateway and Azure WAF on Azure Front Door. Conclusion As we've seen throughout this series, Microsoft provides practical and tactical guidance to help our customers enhance their cyber resiliency to sophisticated and destructive cyberattacks that impact critical business operations. Security Copilot offers new capabilities to help build cyber resiliency in diverse and challenging areas such as: Vulnerability management Data security Multi-cloud management Security operations Identity protection In Building Secure, Resilient Architectures for Cyber Mission Assurance, MITRE emphasizes that “game-changing technologies, techniques, and strategies can make transformational improvements in the resilience of our critical systems.” It's clear that Security Copilot is already one of those game-changers and, with the recent announcement of Security Copilot agents, charting your path to cyber resilience just got a lot more exciting.
LizTesch
May 15, 2025 Place Microsoft Security Community Blog
519Views
1like
0Comments
Announcing Alert Triage Agents in Microsoft Purview, powered by Security Copilot
Powered by Security Copilot, the Alert Triage Agents will help organizations prioritize the most critical risks faster. By triaging alerts based on parameters provided by the organization and fine-tuning the process through feedback provided by the data security teams, the agent will upskill teams, provide faster investigation, and enable more assertive data risk mitigation.
Nathalia_Borges
Mar 24, 2025 Place Microsoft Security Community Blog
4KViews
1like
0Comments
Integrating API data into Microsoft Security Copilot using custom logs and KQL plugins
Microsoft Security Copilot (Copilot) is a generative Artificial Intelligence (AI) system for cybersecurity use cases. Copilot is not a monolithic system but is an ecosystem running on a platform that allows data requests from multiple sources using a unique plugin mechanism. Currently, it supports API, GPT, and KQL-based plugins, API and KQL-based plugins can be used to pull external data into Security Copilot. In this blog post we will discuss how both methods can be combined and how we can get data only available through the API to Security Copilot, while benefiting from KQL plugin simplicity. KQL vs. API plugins KQL-based plugins can gather insights from Microsoft Sentinel workspaces, M365 Defender XDR, and Azure Data Explorer clusters. Such plugins do not require any development skills beyond ability to write KQL queries, do not require any additional authentication mechanism and can be easily extended with new features/queries as needed. API plugins give Copilot the capability to pull data from any external data source if it supports REST API, e.g. allowing Copilot to make Graph API calls. KQL and API plugins each have their specific use cases. The KQL option is often chosen for its simplicity and due to certain limitations associated with API plugins: API plugin request body schemas are limited to a depth of 1, which means they cannot handle deeply nested data structures. Output from APIs often needs to be parsed before Security Copilot can ingest it, as Security Copilot, like all other large language models (LLMs) based applications, has limits on how much information it can process at once, known as a "token limit". API must be publicly available for Copilot to access it, which means API endpoint must be properly secured and authentication method must be supported by Copilot. The best of both worlds A possible solution is to integrate data available only through the API into the Log Analytics workspace, allowing for subsequent querying via KQL. The solution consists of two parts: Logic App to query API data and send it to Log Analytics (Sentinel) workspace. Custom KQL plugin for Security Copilot to query custom tables. As an example, we will build a solution that allows querying Defender XDR Secure Score historical data, which is currently only available through Graph API. Create Logic App to store data retrieved via API in Log Analytics workspace We will start with building a simple Logic App to get API data and send it to Log Analytics. While we use Secure Score data, as an example, the same method can be used for any other data that does not change often and suitable for KQL table storage. The Logic App will do the following: Logic App is triggered once a day, in accordance with Secure Score update schedule (once in 24 hours). It gets the latest Secure Score via HTTP call to Graph API: HTTP GET to https://graph.microsoft.com/v1.0/security/secureScores?$top=1: Graph API call is authenticated via Managed Identity: Managed Identity will require SecurityEvents.Read.All permission to get access to Secure Score data: Connect-AzAccount $GraphAppId = "00000003-0000-0000-c000-000000000000" $NameOfMSI = "LOGIC_APP_NAME” $Permission = "SecurityEvents.Read.All" $GraphServicePrincipal = Get-AzADServicePrincipal -AppId $GraphAppId $AppRole = $GraphServicePrincipal.AppRole | Where-Object { $_.Value -eq $Permission -and $_.Origin -contains "Application" } New-AzADServicePrincipalAppRoleAssignment ` -ServicePrincipalDisplayName $NameOfMSI ` -ResourceDisplayName $GraphServicePrincipal.DisplayName ` -AppRoleId $AppRole.Id Received Secure Score data is sent to Log Analytics workspace using built-in Azure Log Analytics Data Collector connector. For convenience we will split data returned by Secure Score API into two categories to store them in different custom log tables: overall Secure Score values and specific values for each security control. Managed Identity assigned to the Logic App will have to be granted Log Analytics Contributor role on the chosen Log Analytics workspace: As a result of running Logic App for the first time, two custom logs will be generated in the selected Log Analytics workspace. SecureScoreControlsXDR_CL log will contain all information about specific controls: SecureScoreXDR_CL will contain just one entry per day, but it is handy when it comes to tracking Secure Score changes in the organization. Create custom KQL Plugin for Security Copilot Now when we have our data conveniently stored in Log Analytics workspace, we can proceed to creation of custom KQL plugin. Below is an example of such plugin with some basic skills, but thanks to simplicity of KQL plugins, it can easily be extended and adjusted to ones needs: Descriptor: Name: SecureScoreXDRPlugin DisplayName: Defender XDR Secure Score plugin Description: Skills to query and track Microsoft Defender XDR Secure Score SkillGroups: - Format: KQL Skills: - Name: GetSecureScoreXDR DisplayName: Get Defender XDR Secure Score for specific date Description: Queries Defender XDR Secure Score current status for Apps, Identity, Devices, Data and Total ExamplePrompts: - 'Get Defender Secure Score for today' - 'Get Secure Score for 2022-01-01' - 'What is the current Secure Score' - 'What was Secure Score 7 days ago' Inputs: - Name: date Description: The date to query the Secure Score for Required: true Settings: Target: Defender Template: |- let specifieddate = todatetime('{{date}}'); SecureScoreControlsXDR_CL | where TimeGenerated between (startofday(specifieddate) .. endofday(specifieddate)) | summarize IdentityScore = sumif(score_d, controlCategory_s == "Identity"), AppsScore = sumif(score_d, controlCategory_s == "Apps"), DeviceScore = sumif(score_d, controlCategory_s == "Device"), DataScore = sumif(score_d, controlCategory_s == "Data") by bin(TimeGenerated, 1d) | extend TotalScore = (IdentityScore + AppsScore + DeviceScore + DataScore) - Name: GetSecureScoreXDRChanges DisplayName: Get Defender XDR Secure Score controls changes for the past 7 days Description: Queries Defender XDR Secure Score and shows changes during the past 7 days ExamplePrompts: - 'How did secure score change in the past week' - 'What are secure score controls changes' - 'Show recent changes across secure score controls' - 'Show secure score changes for the past 7 days' Inputs: - Name: date Description: The date to query the Secure Score for Required: true Settings: Target: Defender Template: |- let specifieddate = todatetime('{{date}}'); let Controls = SecureScoreControlsXDR_CL | project TimeGenerated, RecommendationCategory=controlCategory_s, ControlName=controlName_s, Recommendation=description_s, ImplementationStatus=implementationStatus_s, ControlScore = score_d | where TimeGenerated >= specifieddate; Controls | summarize distinctScoreCount = count_distinct(ControlScore) by ControlName | where distinctScoreCount > 1 | join kind=inner ( Controls ) on ControlName | summarize TimeGenerated = max(TimeGenerated) by ControlName | join kind=inner ( Controls) on TimeGenerated, ControlName | project TimeGenerated, ControlName, RecommendationCategory, Recommendation, ImplementationStatus, ControlScore Now we need to save text above to YAML file and add it as custom KQL plugin: Once plugin is deployed, we can query and track Secure Score data using Security Copilot: Conclusion Storing non-log data within a Log Analytics workspace is an established practice. This method has been used to allow security analysts easy access to supplementary data via KQL, facilitating its use in KQL queries for detection enrichment purposes. As illustrated in the scenario above, we can still generate alerts based on this data, such as notifications for declining Secure Scores. Additionally, this approach now enables further AI-powered Security Copilot scenarios.
AlexanderZ
Feb 18, 2025 Place Microsoft Security Community Blog
1.1KViews
1like
0Comments

"}},"componentScriptGroups({\"componentId\":\"custom.widget.MicrosoftFooter\"})":{"__typename":"ComponentScriptGroups","scriptGroups":{"__typename":"ComponentScriptGroupsDefinition","afterInteractive":{"__typename":"PageScriptGroupDefinition","group":"AFTER_INTERACTIVE","scriptIds":[]},"lazyOnLoad":{"__typename":"PageScriptGroupDefinition","group":"LAZY_ON_LOAD","scriptIds":[]}},"componentScripts":[]},"cachedText({\"lastModified\":\"1750857401000\",\"locale\":\"en-US\",\"namespaces\":[\"components/community/NavbarDropdownToggle\"]})":[{"__ref":"CachedAsset:text:en_US-components/community/NavbarDropdownToggle-1750857401000"}],"cachedText({\"lastModified\":\"1750857401000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageListTabs\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageListTabs-1750857401000"}],"cachedText({\"lastModified\":\"1750857401000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageView/MessageViewInline\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageView/MessageViewInline-1750857401000"}],"cachedText({\"lastModified\":\"1750857401000\",\"locale\":\"en-US\",\"namespaces\":[\"shared/client/components/common/Pager/PagerLoadMore\"]})":[{"__ref":"CachedAsset:text:en_US-shared/client/components/common/Pager/PagerLoadMore-1750857401000"}],"cachedText({\"lastModified\":\"1750857401000\",\"locale\":\"en-US\",\"namespaces\":[\"shared/client/components/common/OverflowNav\"]})":[{"__ref":"CachedAsset:text:en_US-shared/client/components/common/OverflowNav-1750857401000"}],"cachedText({\"lastModified\":\"1750857401000\",\"locale\":\"en-US\",\"namespaces\":[\"components/users/UserLink\"]})":[{"__ref":"CachedAsset:text:en_US-components/users/UserLink-1750857401000"}],"cachedText({\"lastModified\":\"1750857401000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageSubject\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageSubject-1750857401000"}],"cachedText({\"lastModified\":\"1750857401000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageTime\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageTime-1750857401000"}],"cachedText({\"lastModified\":\"1750857401000\",\"locale\":\"en-US\",\"namespaces\":[\"shared/client/components/nodes/NodeIcon\"]})":[{"__ref":"CachedAsset:text:en_US-shared/client/components/nodes/NodeIcon-1750857401000"}],"cachedText({\"lastModified\":\"1750857401000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageUnreadCount\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageUnreadCount-1750857401000"}],"cachedText({\"lastModified\":\"1750857401000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageViewCount\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageViewCount-1750857401000"}],"cachedText({\"lastModified\":\"1750857401000\",\"locale\":\"en-US\",\"namespaces\":[\"components/kudos/KudosCount\"]})":[{"__ref":"CachedAsset:text:en_US-components/kudos/KudosCount-1750857401000"}],"cachedText({\"lastModified\":\"1750857401000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageRepliesCount\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageRepliesCount-1750857401000"}],"cachedText({\"lastModified\":\"1750857401000\",\"locale\":\"en-US\",\"namespaces\":[\"components/messages/MessageBody\"]})":[{"__ref":"CachedAsset:text:en_US-components/messages/MessageBody-1750857401000"}],"cachedText({\"lastModified\":\"1750857401000\",\"locale\":\"en-US\",\"namespaces\":[\"shared/client/components/users/UserAvatar\"]})":[{"__ref":"CachedAsset:text:en_US-shared/client/components/users/UserAvatar-1750857401000"}]},"Theme:customTheme1":{"__typename":"Theme","id":"customTheme1"},"User:user:-1":{"__typename":"User","id":"user:-1","uid":-1,"login":"Deleted","email":"","avatar":null,"rank":null,"kudosWeight":1,"registrationData":{"__typename":"RegistrationData","status":"ANONYMOUS","registrationTime":null,"confirmEmailStatus":false,"registrationAccessLevel":"VIEW","ssoRegistrationFields":[]},"ssoId":null,"profileSettings":{"__typename":"ProfileSettings","dateDisplayStyle":{"__typename":"InheritableStringSettingWithPossibleValues","key":"layout.friendly_dates_enabled","value":"false","localValue":"true","possibleValues":["true","false"]},"dateDisplayFormat":{"__typename":"InheritableStringSetting","key":"layout.format_pattern_date","value":"MMM dd yyyy","localValue":"MM-dd-yyyy"},"language":{"__typename":"InheritableStringSettingWithPossibleValues","key":"profile.language","value":"en-US","localValue":null,"possibleValues":["en-US","es-ES"]},"repliesSortOrder":{"__typename":"InheritableStringSettingWithPossibleValues","key":"config.user_replies_sort_order","value":"DEFAULT","localValue":"DEFAULT","possibleValues":["DEFAULT","LIKES","PUBLISH_TIME","REVERSE_PUBLISH_TIME"]}},"deleted":false},"CachedAsset:pages-1752222492861":{"__typename":"CachedAsset","id":"pages-1752222492861","value":[{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"BlogViewAllPostsPage","type":"BLOG","urlPath":"/category/:categoryId/blog/:boardId/all-posts/(/:after|/:before)?","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"CasePortalPage","type":"CASE_PORTAL","urlPath":"/caseportal","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"CreateGroupHubPage","type":"GROUP_HUB","urlPath":"/groups/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"CaseViewPage","type":"CASE_DETAILS","urlPath":"/case/:caseId/:caseNumber","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"InboxPage","type":"COMMUNITY","urlPath":"/inbox","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"HelpFAQPage","type":"COMMUNITY","urlPath":"/help","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"IdeaMessagePage","type":"IDEA_POST","urlPath":"/idea/:boardId/:messageSubject/:messageId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"IdeaViewAllIdeasPage","type":"IDEA","urlPath":"/category/:categoryId/ideas/:boardId/all-ideas/(/:after|/:before)?","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"LoginPage","type":"USER","urlPath":"/signin","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"BlogPostPage","type":"BLOG","urlPath":"/category/:categoryId/blogs/:boardId/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"UserBlogPermissions.Page","type":"COMMUNITY","urlPath":"/c/user-blog-permissions/page","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"ThemeEditorPage","type":"COMMUNITY","urlPath":"/designer/themes","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"TkbViewAllArticlesPage","type":"TKB","urlPath":"/category/:categoryId/kb/:boardId/all-articles/(/:after|/:before)?","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1730819800000,"localOverride":null,"page":{"id":"AllEvents","type":"CUSTOM","urlPath":"/Events","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"OccasionEditPage","type":"EVENT","urlPath":"/event/:boardId/:messageSubject/:messageId/edit","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"OAuthAuthorizationAllowPage","type":"USER","urlPath":"/auth/authorize/allow","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"PageEditorPage","type":"COMMUNITY","urlPath":"/designer/pages","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"PostPage","type":"COMMUNITY","urlPath":"/category/:categoryId/:boardId/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"CreateUserGroup.Page","type":"COMMUNITY","urlPath":"/c/create-user-group/page","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"ForumBoardPage","type":"FORUM","urlPath":"/category/:categoryId/discussions/:boardId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"TkbBoardPage","type":"TKB","urlPath":"/category/:categoryId/kb/:boardId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"EventPostPage","type":"EVENT","urlPath":"/category/:categoryId/events/:boardId/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"UserBadgesPage","type":"COMMUNITY","urlPath":"/users/:login/:userId/badges","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"GroupHubMembershipAction","type":"GROUP_HUB","urlPath":"/membership/join/:nodeId/:membershipType","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"MaintenancePage","type":"COMMUNITY","urlPath":"/maintenance","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"IdeaReplyPage","type":"IDEA_REPLY","urlPath":"/idea/:boardId/:messageSubject/:messageId/comments/:replyId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"UserSettingsPage","type":"USER","urlPath":"/mysettings/:userSettingsTab","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"GroupHubsPage","type":"GROUP_HUB","urlPath":"/groups","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"ForumPostPage","type":"FORUM","urlPath":"/category/:categoryId/discussions/:boardId/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"OccasionRsvpActionPage","type":"OCCASION","urlPath":"/event/:boardId/:messageSubject/:messageId/rsvp/:responseType","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"VerifyUserEmailPage","type":"USER","urlPath":"/verifyemail/:userId/:verifyEmailToken","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"AllOccasionsPage","type":"OCCASION","urlPath":"/category/:categoryId/events/:boardId/all-events/(/:after|/:before)?","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"EventBoardPage","type":"EVENT","urlPath":"/category/:categoryId/events/:boardId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"TkbReplyPage","type":"TKB_REPLY","urlPath":"/kb/:boardId/:messageSubject/:messageId/comments/:replyId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"IdeaBoardPage","type":"IDEA","urlPath":"/category/:categoryId/ideas/:boardId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"CommunityGuideLinesPage","type":"COMMUNITY","urlPath":"/communityguidelines","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"CaseCreatePage","type":"SALESFORCE_CASE_CREATION","urlPath":"/caseportal/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"TkbEditPage","type":"TKB","urlPath":"/kb/:boardId/:messageSubject/:messageId/edit","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"ForgotPasswordPage","type":"USER","urlPath":"/forgotpassword","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"IdeaEditPage","type":"IDEA","urlPath":"/idea/:boardId/:messageSubject/:messageId/edit","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"TagPage","type":"COMMUNITY","urlPath":"/tag/:tagName","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"BlogBoardPage","type":"BLOG","urlPath":"/category/:categoryId/blog/:boardId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"OccasionMessagePage","type":"OCCASION_TOPIC","urlPath":"/event/:boardId/:messageSubject/:messageId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"ManageContentPage","type":"COMMUNITY","urlPath":"/managecontent","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"ClosedMembershipNodeNonMembersPage","type":"GROUP_HUB","urlPath":"/closedgroup/:groupHubId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"CommunityPage","type":"COMMUNITY","urlPath":"/","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"ForumMessagePage","type":"FORUM_TOPIC","urlPath":"/discussions/:boardId/:messageSubject/:messageId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"IdeaPostPage","type":"IDEA","urlPath":"/category/:categoryId/ideas/:boardId/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1730819800000,"localOverride":null,"page":{"id":"CommunityHub.Page","type":"CUSTOM","urlPath":"/Directory","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"BlogMessagePage","type":"BLOG_ARTICLE","urlPath":"/blog/:boardId/:messageSubject/:messageId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"RegistrationPage","type":"USER","urlPath":"/register","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"EditGroupHubPage","type":"GROUP_HUB","urlPath":"/group/:groupHubId/edit","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"ForumEditPage","type":"FORUM","urlPath":"/discussions/:boardId/:messageSubject/:messageId/edit","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"ResetPasswordPage","type":"USER","urlPath":"/resetpassword/:userId/:resetPasswordToken","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1730819800000,"localOverride":null,"page":{"id":"AllBlogs.Page","type":"CUSTOM","urlPath":"/blogs","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"TkbMessagePage","type":"TKB_ARTICLE","urlPath":"/kb/:boardId/:messageSubject/:messageId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"BlogEditPage","type":"BLOG","urlPath":"/blog/:boardId/:messageSubject/:messageId/edit","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"ManageUsersPage","type":"USER","urlPath":"/users/manage/:tab?/:manageUsersTab?","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"ForumReplyPage","type":"FORUM_REPLY","urlPath":"/discussions/:boardId/:messageSubject/:messageId/replies/:replyId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"PrivacyPolicyPage","type":"COMMUNITY","urlPath":"/privacypolicy","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"NotificationPage","type":"COMMUNITY","urlPath":"/notifications","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"UserPage","type":"USER","urlPath":"/users/:login/:userId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"HealthCheckPage","type":"COMMUNITY","urlPath":"/health","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"OccasionReplyPage","type":"OCCASION_REPLY","urlPath":"/event/:boardId/:messageSubject/:messageId/comments/:replyId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"ManageMembersPage","type":"GROUP_HUB","urlPath":"/group/:groupHubId/manage/:tab?","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"SearchResultsPage","type":"COMMUNITY","urlPath":"/search","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"BlogReplyPage","type":"BLOG_REPLY","urlPath":"/blog/:boardId/:messageSubject/:messageId/replies/:replyId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"GroupHubPage","type":"GROUP_HUB","urlPath":"/group/:groupHubId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"TermsOfServicePage","type":"COMMUNITY","urlPath":"/termsofservice","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"CategoryPage","type":"CATEGORY","urlPath":"/category/:categoryId","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"ForumViewAllTopicsPage","type":"FORUM","urlPath":"/category/:categoryId/discussions/:boardId/all-topics/(/:after|/:before)?","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"TkbPostPage","type":"TKB","urlPath":"/category/:categoryId/kbs/:boardId/create","__typename":"PageDescriptor"},"__typename":"PageResource"},{"lastUpdatedTime":1752222492861,"localOverride":null,"page":{"id":"GroupHubPostPage","type":"GROUP_HUB","urlPath":"/group/:groupHubId/:boardId/create","__typename":"PageDescriptor"},"__typename":"PageResource"}],"localOverride":false},"CachedAsset:text:en_US-components/context/AppContext/AppContextProvider-0":{"__typename":"CachedAsset","id":"text:en_US-components/context/AppContext/AppContextProvider-0","value":{"noCommunity":"Cannot find community","noUser":"Cannot find current user","noNode":"Cannot find node with id {nodeId}","noMessage":"Cannot find message with id {messageId}","userBanned":"We're sorry, but you have been banned from using this site.","userBannedReason":"You have been banned for the following reason: {reason}"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/common/Loading/LoadingDot-0":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/common/Loading/LoadingDot-0","value":{"title":"Loading..."},"localOverride":false},"CachedAsset:theme:customTheme1-1752222492274":{"__typename":"CachedAsset","id":"theme:customTheme1-1752222492274","value":{"id":"customTheme1","animation":{"fast":"150ms","normal":"250ms","slow":"500ms","slowest":"750ms","function":"cubic-bezier(0.07, 0.91, 0.51, 1)","__typename":"AnimationThemeSettings"},"avatar":{"borderRadius":"50%","collections":["default"],"__typename":"AvatarThemeSettings"},"basics":{"browserIcon":{"imageAssetName":"favicon-1730836283320.png","imageLastModified":"1730836286415","__typename":"ThemeAsset"},"customerLogo":{"imageAssetName":"favicon-1730836271365.png","imageLastModified":"1730836274203","__typename":"ThemeAsset"},"maximumWidthOfPageContent":"1300px","oneColumnNarrowWidth":"1200px","gridGutterWidthMd":"30px","gridGutterWidthXs":"10px","pageWidthStyle":"WIDTH_OF_BROWSER","__typename":"BasicsThemeSettings"},"buttons":{"borderRadiusSm":"3px","borderRadius":"3px","borderRadiusLg":"5px","paddingY":"5px","paddingYLg":"7px","paddingYHero":"var(--lia-bs-btn-padding-y-lg)","paddingX":"12px","paddingXLg":"16px","paddingXHero":"60px","fontStyle":"NORMAL","fontWeight":"700","textTransform":"NONE","disabledOpacity":0.5,"primaryTextColor":"var(--lia-bs-white)","primaryTextHoverColor":"var(--lia-bs-white)","primaryTextActiveColor":"var(--lia-bs-white)","primaryBgColor":"var(--lia-bs-primary)","primaryBgHoverColor":"hsl(var(--lia-bs-primary-h), var(--lia-bs-primary-s), calc(var(--lia-bs-primary-l) * 0.85))","primaryBgActiveColor":"hsl(var(--lia-bs-primary-h), var(--lia-bs-primary-s), calc(var(--lia-bs-primary-l) * 0.7))","primaryBorder":"1px solid transparent","primaryBorderHover":"1px solid transparent","primaryBorderActive":"1px solid transparent","primaryBorderFocus":"1px solid var(--lia-bs-white)","primaryBoxShadowFocus":"0 0 0 1px var(--lia-bs-primary), 0 0 0 4px hsla(var(--lia-bs-primary-h), var(--lia-bs-primary-s), var(--lia-bs-primary-l), 0.2)","secondaryTextColor":"var(--lia-bs-gray-900)","secondaryTextHoverColor":"hsl(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), calc(var(--lia-bs-gray-900-l) * 0.95))","secondaryTextActiveColor":"hsl(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), calc(var(--lia-bs-gray-900-l) * 0.9))","secondaryBgColor":"var(--lia-bs-gray-200)","secondaryBgHoverColor":"hsl(var(--lia-bs-gray-200-h), var(--lia-bs-gray-200-s), calc(var(--lia-bs-gray-200-l) * 0.96))","secondaryBgActiveColor":"hsl(var(--lia-bs-gray-200-h), var(--lia-bs-gray-200-s), calc(var(--lia-bs-gray-200-l) * 0.92))","secondaryBorder":"1px solid transparent","secondaryBorderHover":"1px solid transparent","secondaryBorderActive":"1px solid transparent","secondaryBorderFocus":"1px solid transparent","secondaryBoxShadowFocus":"0 0 0 1px var(--lia-bs-primary), 0 0 0 4px hsla(var(--lia-bs-primary-h), var(--lia-bs-primary-s), var(--lia-bs-primary-l), 0.2)","tertiaryTextColor":"var(--lia-bs-gray-900)","tertiaryTextHoverColor":"hsl(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), calc(var(--lia-bs-gray-900-l) * 0.95))","tertiaryTextActiveColor":"hsl(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), calc(var(--lia-bs-gray-900-l) * 0.9))","tertiaryBgColor":"transparent","tertiaryBgHoverColor":"transparent","tertiaryBgActiveColor":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.04)","tertiaryBorder":"1px solid transparent","tertiaryBorderHover":"1px solid hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.08)","tertiaryBorderActive":"1px solid transparent","tertiaryBorderFocus":"1px solid transparent","tertiaryBoxShadowFocus":"0 0 0 1px var(--lia-bs-primary), 0 0 0 4px hsla(var(--lia-bs-primary-h), var(--lia-bs-primary-s), var(--lia-bs-primary-l), 0.2)","destructiveTextColor":"var(--lia-bs-danger)","destructiveTextHoverColor":"hsl(var(--lia-bs-danger-h), var(--lia-bs-danger-s), calc(var(--lia-bs-danger-l) * 0.95))","destructiveTextActiveColor":"hsl(var(--lia-bs-danger-h), var(--lia-bs-danger-s), calc(var(--lia-bs-danger-l) * 0.9))","destructiveBgColor":"var(--lia-bs-gray-200)","destructiveBgHoverColor":"hsl(var(--lia-bs-gray-200-h), var(--lia-bs-gray-200-s), calc(var(--lia-bs-gray-200-l) * 0.96))","destructiveBgActiveColor":"hsl(var(--lia-bs-gray-200-h), var(--lia-bs-gray-200-s), calc(var(--lia-bs-gray-200-l) * 0.92))","destructiveBorder":"1px solid transparent","destructiveBorderHover":"1px solid transparent","destructiveBorderActive":"1px solid transparent","destructiveBorderFocus":"1px solid transparent","destructiveBoxShadowFocus":"0 0 0 1px var(--lia-bs-primary), 0 0 0 4px hsla(var(--lia-bs-primary-h), var(--lia-bs-primary-s), var(--lia-bs-primary-l), 0.2)","__typename":"ButtonsThemeSettings"},"border":{"color":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.08)","mainContent":"NONE","sideContent":"LIGHT","radiusSm":"3px","radius":"5px","radiusLg":"9px","radius50":"100vw","__typename":"BorderThemeSettings"},"boxShadow":{"xs":"0 0 0 1px hsla(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), var(--lia-bs-gray-900-l), 0.08), 0 3px 0 -1px hsla(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), var(--lia-bs-gray-900-l), 0.16)","sm":"0 2px 4px hsla(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), var(--lia-bs-gray-900-l), 0.12)","md":"0 5px 15px hsla(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), var(--lia-bs-gray-900-l), 0.3)","lg":"0 10px 30px hsla(var(--lia-bs-gray-900-h), var(--lia-bs-gray-900-s), var(--lia-bs-gray-900-l), 0.3)","__typename":"BoxShadowThemeSettings"},"cards":{"bgColor":"var(--lia-panel-bg-color)","borderRadius":"var(--lia-panel-border-radius)","boxShadow":"var(--lia-box-shadow-xs)","__typename":"CardsThemeSettings"},"chip":{"maxWidth":"300px","height":"30px","__typename":"ChipThemeSettings"},"coreTypes":{"defaultMessageLinkColor":"var(--lia-bs-link-color)","defaultMessageLinkDecoration":"none","defaultMessageLinkFontStyle":"NORMAL","defaultMessageLinkFontWeight":"400","defaultMessageFontStyle":"NORMAL","defaultMessageFontWeight":"400","defaultMessageFontFamily":"var(--lia-bs-font-family-base)","forumColor":"#4099E2","forumFontFamily":"var(--lia-bs-font-family-base)","forumFontWeight":"var(--lia-default-message-font-weight)","forumLineHeight":"var(--lia-bs-line-height-base)","forumFontStyle":"var(--lia-default-message-font-style)","forumMessageLinkColor":"var(--lia-default-message-link-color)","forumMessageLinkDecoration":"var(--lia-default-message-link-decoration)","forumMessageLinkFontStyle":"var(--lia-default-message-link-font-style)","forumMessageLinkFontWeight":"var(--lia-default-message-link-font-weight)","forumSolvedColor":"#148563","blogColor":"#1CBAA0","blogFontFamily":"var(--lia-bs-font-family-base)","blogFontWeight":"var(--lia-default-message-font-weight)","blogLineHeight":"1.75","blogFontStyle":"var(--lia-default-message-font-style)","blogMessageLinkColor":"var(--lia-default-message-link-color)","blogMessageLinkDecoration":"var(--lia-default-message-link-decoration)","blogMessageLinkFontStyle":"var(--lia-default-message-link-font-style)","blogMessageLinkFontWeight":"var(--lia-default-message-link-font-weight)","tkbColor":"#4C6B90","tkbFontFamily":"var(--lia-bs-font-family-base)","tkbFontWeight":"var(--lia-default-message-font-weight)","tkbLineHeight":"1.75","tkbFontStyle":"var(--lia-default-message-font-style)","tkbMessageLinkColor":"var(--lia-default-message-link-color)","tkbMessageLinkDecoration":"var(--lia-default-message-link-decoration)","tkbMessageLinkFontStyle":"var(--lia-default-message-link-font-style)","tkbMessageLinkFontWeight":"var(--lia-default-message-link-font-weight)","qandaColor":"#4099E2","qandaFontFamily":"var(--lia-bs-font-family-base)","qandaFontWeight":"var(--lia-default-message-font-weight)","qandaLineHeight":"var(--lia-bs-line-height-base)","qandaFontStyle":"var(--lia-default-message-link-font-style)","qandaMessageLinkColor":"var(--lia-default-message-link-color)","qandaMessageLinkDecoration":"var(--lia-default-message-link-decoration)","qandaMessageLinkFontStyle":"var(--lia-default-message-link-font-style)","qandaMessageLinkFontWeight":"var(--lia-default-message-link-font-weight)","qandaSolvedColor":"#3FA023","ideaColor":"#FF8000","ideaFontFamily":"var(--lia-bs-font-family-base)","ideaFontWeight":"var(--lia-default-message-font-weight)","ideaLineHeight":"var(--lia-bs-line-height-base)","ideaFontStyle":"var(--lia-default-message-font-style)","ideaMessageLinkColor":"var(--lia-default-message-link-color)","ideaMessageLinkDecoration":"var(--lia-default-message-link-decoration)","ideaMessageLinkFontStyle":"var(--lia-default-message-link-font-style)","ideaMessageLinkFontWeight":"var(--lia-default-message-link-font-weight)","contestColor":"#FCC845","contestFontFamily":"var(--lia-bs-font-family-base)","contestFontWeight":"var(--lia-default-message-font-weight)","contestLineHeight":"var(--lia-bs-line-height-base)","contestFontStyle":"var(--lia-default-message-link-font-style)","contestMessageLinkColor":"var(--lia-default-message-link-color)","contestMessageLinkDecoration":"var(--lia-default-message-link-decoration)","contestMessageLinkFontStyle":"ITALIC","contestMessageLinkFontWeight":"var(--lia-default-message-link-font-weight)","occasionColor":"#D13A1F","occasionFontFamily":"var(--lia-bs-font-family-base)","occasionFontWeight":"var(--lia-default-message-font-weight)","occasionLineHeight":"var(--lia-bs-line-height-base)","occasionFontStyle":"var(--lia-default-message-font-style)","occasionMessageLinkColor":"var(--lia-default-message-link-color)","occasionMessageLinkDecoration":"var(--lia-default-message-link-decoration)","occasionMessageLinkFontStyle":"var(--lia-default-message-link-font-style)","occasionMessageLinkFontWeight":"var(--lia-default-message-link-font-weight)","grouphubColor":"#333333","categoryColor":"#949494","communityColor":"#FFFFFF","productColor":"#949494","__typename":"CoreTypesThemeSettings"},"colors":{"black":"#000000","white":"#FFFFFF","gray100":"#F7F7F7","gray200":"#F7F7F7","gray300":"#E8E8E8","gray400":"#D9D9D9","gray500":"#CCCCCC","gray600":"#717171","gray700":"#707070","gray800":"#545454","gray900":"#333333","dark":"#545454","light":"#F7F7F7","primary":"#0069D4","secondary":"#333333","bodyText":"#1E1E1E","bodyBg":"#FFFFFF","info":"#409AE2","success":"#41C5AE","warning":"#FCC844","danger":"#BC341B","alertSystem":"#FF6600","textMuted":"#707070","highlight":"#FFFCAD","outline":"var(--lia-bs-primary)","custom":["#D3F5A4","#243A5E"],"__typename":"ColorsThemeSettings"},"divider":{"size":"3px","marginLeft":"4px","marginRight":"4px","borderRadius":"50%","bgColor":"var(--lia-bs-gray-600)","bgColorActive":"var(--lia-bs-gray-600)","__typename":"DividerThemeSettings"},"dropdown":{"fontSize":"var(--lia-bs-font-size-sm)","borderColor":"var(--lia-bs-border-color)","borderRadius":"var(--lia-bs-border-radius-sm)","dividerBg":"var(--lia-bs-gray-300)","itemPaddingY":"5px","itemPaddingX":"20px","headerColor":"var(--lia-bs-gray-700)","__typename":"DropdownThemeSettings"},"email":{"link":{"color":"#0069D4","hoverColor":"#0061c2","decoration":"none","hoverDecoration":"underline","__typename":"EmailLinkSettings"},"border":{"color":"#e4e4e4","__typename":"EmailBorderSettings"},"buttons":{"borderRadiusLg":"5px","paddingXLg":"16px","paddingYLg":"7px","fontWeight":"700","primaryTextColor":"#ffffff","primaryTextHoverColor":"#ffffff","primaryBgColor":"#0069D4","primaryBgHoverColor":"#005cb8","primaryBorder":"1px solid transparent","primaryBorderHover":"1px solid transparent","__typename":"EmailButtonsSettings"},"panel":{"borderRadius":"5px","borderColor":"#e4e4e4","__typename":"EmailPanelSettings"},"__typename":"EmailThemeSettings"},"emoji":{"skinToneDefault":"#ffcd43","skinToneLight":"#fae3c5","skinToneMediumLight":"#e2cfa5","skinToneMedium":"#daa478","skinToneMediumDark":"#a78058","skinToneDark":"#5e4d43","__typename":"EmojiThemeSettings"},"heading":{"color":"var(--lia-bs-body-color)","fontFamily":"Segoe UI","fontStyle":"NORMAL","fontWeight":"400","h1FontSize":"34px","h2FontSize":"32px","h3FontSize":"28px","h4FontSize":"24px","h5FontSize":"20px","h6FontSize":"16px","lineHeight":"1.3","subHeaderFontSize":"11px","subHeaderFontWeight":"500","h1LetterSpacing":"normal","h2LetterSpacing":"normal","h3LetterSpacing":"normal","h4LetterSpacing":"normal","h5LetterSpacing":"normal","h6LetterSpacing":"normal","subHeaderLetterSpacing":"2px","h1FontWeight":"var(--lia-bs-headings-font-weight)","h2FontWeight":"var(--lia-bs-headings-font-weight)","h3FontWeight":"var(--lia-bs-headings-font-weight)","h4FontWeight":"var(--lia-bs-headings-font-weight)","h5FontWeight":"var(--lia-bs-headings-font-weight)","h6FontWeight":"var(--lia-bs-headings-font-weight)","__typename":"HeadingThemeSettings"},"icons":{"size10":"10px","size12":"12px","size14":"14px","size16":"16px","size20":"20px","size24":"24px","size30":"30px","size40":"40px","size50":"50px","size60":"60px","size80":"80px","size120":"120px","size160":"160px","__typename":"IconsThemeSettings"},"imagePreview":{"bgColor":"var(--lia-bs-gray-900)","titleColor":"var(--lia-bs-white)","controlColor":"var(--lia-bs-white)","controlBgColor":"var(--lia-bs-gray-800)","__typename":"ImagePreviewThemeSettings"},"input":{"borderColor":"var(--lia-bs-gray-600)","disabledColor":"var(--lia-bs-gray-600)","focusBorderColor":"var(--lia-bs-primary)","labelMarginBottom":"10px","btnFontSize":"var(--lia-bs-font-size-sm)","focusBoxShadow":"0 0 0 3px hsla(var(--lia-bs-primary-h), var(--lia-bs-primary-s), var(--lia-bs-primary-l), 0.2)","checkLabelMarginBottom":"2px","checkboxBorderRadius":"3px","borderRadiusSm":"var(--lia-bs-border-radius-sm)","borderRadius":"var(--lia-bs-border-radius)","borderRadiusLg":"var(--lia-bs-border-radius-lg)","formTextMarginTop":"4px","textAreaBorderRadius":"var(--lia-bs-border-radius)","activeFillColor":"var(--lia-bs-primary)","__typename":"InputThemeSettings"},"loading":{"dotDarkColor":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.2)","dotLightColor":"hsla(var(--lia-bs-white-h), var(--lia-bs-white-s), var(--lia-bs-white-l), 0.5)","barDarkColor":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.06)","barLightColor":"hsla(var(--lia-bs-white-h), var(--lia-bs-white-s), var(--lia-bs-white-l), 0.4)","__typename":"LoadingThemeSettings"},"link":{"color":"var(--lia-bs-primary)","hoverColor":"hsl(var(--lia-bs-primary-h), var(--lia-bs-primary-s), calc(var(--lia-bs-primary-l) - 10%))","decoration":"none","hoverDecoration":"underline","__typename":"LinkThemeSettings"},"listGroup":{"itemPaddingY":"15px","itemPaddingX":"15px","borderColor":"var(--lia-bs-gray-300)","__typename":"ListGroupThemeSettings"},"modal":{"contentTextColor":"var(--lia-bs-body-color)","contentBg":"var(--lia-bs-white)","backgroundBg":"var(--lia-bs-black)","smSize":"440px","mdSize":"760px","lgSize":"1080px","backdropOpacity":0.3,"contentBoxShadowXs":"var(--lia-bs-box-shadow-sm)","contentBoxShadow":"var(--lia-bs-box-shadow)","headerFontWeight":"700","__typename":"ModalThemeSettings"},"navbar":{"position":"FIXED","background":{"attachment":null,"clip":null,"color":"var(--lia-bs-white)","imageAssetName":"","imageLastModified":"0","origin":null,"position":"CENTER_CENTER","repeat":"NO_REPEAT","size":"COVER","__typename":"BackgroundProps"},"backgroundOpacity":0.8,"paddingTop":"15px","paddingBottom":"15px","borderBottom":"1px solid var(--lia-bs-border-color)","boxShadow":"var(--lia-bs-box-shadow-sm)","brandMarginRight":"30px","brandMarginRightSm":"10px","brandLogoHeight":"30px","linkGap":"10px","linkJustifyContent":"flex-start","linkPaddingY":"5px","linkPaddingX":"10px","linkDropdownPaddingY":"9px","linkDropdownPaddingX":"var(--lia-nav-link-px)","linkColor":"var(--lia-bs-body-color)","linkHoverColor":"var(--lia-bs-primary)","linkFontSize":"var(--lia-bs-font-size-sm)","linkFontStyle":"NORMAL","linkFontWeight":"400","linkTextTransform":"NONE","linkLetterSpacing":"normal","linkBorderRadius":"var(--lia-bs-border-radius-sm)","linkBgColor":"transparent","linkBgHoverColor":"transparent","linkBorder":"none","linkBorderHover":"none","linkBoxShadow":"none","linkBoxShadowHover":"none","linkTextBorderBottom":"none","linkTextBorderBottomHover":"none","dropdownPaddingTop":"10px","dropdownPaddingBottom":"15px","dropdownPaddingX":"10px","dropdownMenuOffset":"2px","dropdownDividerMarginTop":"10px","dropdownDividerMarginBottom":"10px","dropdownBorderColor":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.08)","controllerBgHoverColor":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.1)","controllerIconColor":"var(--lia-bs-body-color)","controllerIconHoverColor":"var(--lia-bs-body-color)","controllerTextColor":"var(--lia-nav-controller-icon-color)","controllerTextHoverColor":"var(--lia-nav-controller-icon-hover-color)","controllerHighlightColor":"hsla(30, 100%, 50%)","controllerHighlightTextColor":"var(--lia-yiq-light)","controllerBorderRadius":"var(--lia-border-radius-50)","hamburgerColor":"var(--lia-nav-controller-icon-color)","hamburgerHoverColor":"var(--lia-nav-controller-icon-color)","hamburgerBgColor":"transparent","hamburgerBgHoverColor":"transparent","hamburgerBorder":"none","hamburgerBorderHover":"none","collapseMenuMarginLeft":"20px","collapseMenuDividerBg":"var(--lia-nav-link-color)","collapseMenuDividerOpacity":0.16,"__typename":"NavbarThemeSettings"},"pager":{"textColor":"var(--lia-bs-link-color)","textFontWeight":"var(--lia-font-weight-md)","textFontSize":"var(--lia-bs-font-size-sm)","__typename":"PagerThemeSettings"},"panel":{"bgColor":"var(--lia-bs-white)","borderRadius":"var(--lia-bs-border-radius)","borderColor":"var(--lia-bs-border-color)","boxShadow":"none","__typename":"PanelThemeSettings"},"popover":{"arrowHeight":"8px","arrowWidth":"16px","maxWidth":"300px","minWidth":"100px","headerBg":"var(--lia-bs-white)","borderColor":"var(--lia-bs-border-color)","borderRadius":"var(--lia-bs-border-radius)","boxShadow":"0 0.5rem 1rem hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.15)","__typename":"PopoverThemeSettings"},"prism":{"color":"#000000","bgColor":"#f5f2f0","fontFamily":"var(--font-family-monospace)","fontSize":"var(--lia-bs-font-size-base)","fontWeightBold":"var(--lia-bs-font-weight-bold)","fontStyleItalic":"italic","tabSize":2,"highlightColor":"#b3d4fc","commentColor":"#62707e","punctuationColor":"#6f6f6f","namespaceOpacity":"0.7","propColor":"#990055","selectorColor":"#517a00","operatorColor":"#906736","operatorBgColor":"hsla(0, 0%, 100%, 0.5)","keywordColor":"#0076a9","functionColor":"#d3284b","variableColor":"#c14700","__typename":"PrismThemeSettings"},"rte":{"bgColor":"var(--lia-bs-white)","borderRadius":"var(--lia-panel-border-radius)","boxShadow":" var(--lia-panel-box-shadow)","customColor1":"#bfedd2","customColor2":"#fbeeb8","customColor3":"#f8cac6","customColor4":"#eccafa","customColor5":"#c2e0f4","customColor6":"#2dc26b","customColor7":"#f1c40f","customColor8":"#e03e2d","customColor9":"#b96ad9","customColor10":"#3598db","customColor11":"#169179","customColor12":"#e67e23","customColor13":"#ba372a","customColor14":"#843fa1","customColor15":"#236fa1","customColor16":"#ecf0f1","customColor17":"#ced4d9","customColor18":"#95a5a6","customColor19":"#7e8c8d","customColor20":"#34495e","customColor21":"#000000","customColor22":"#ffffff","defaultMessageHeaderMarginTop":"40px","defaultMessageHeaderMarginBottom":"20px","defaultMessageItemMarginTop":"0","defaultMessageItemMarginBottom":"10px","diffAddedColor":"hsla(170, 53%, 51%, 0.4)","diffChangedColor":"hsla(43, 97%, 63%, 0.4)","diffNoneColor":"hsla(0, 0%, 80%, 0.4)","diffRemovedColor":"hsla(9, 74%, 47%, 0.4)","specialMessageHeaderMarginTop":"40px","specialMessageHeaderMarginBottom":"20px","specialMessageItemMarginTop":"0","specialMessageItemMarginBottom":"10px","__typename":"RteThemeSettings"},"tags":{"bgColor":"var(--lia-bs-gray-200)","bgHoverColor":"var(--lia-bs-gray-400)","borderRadius":"var(--lia-bs-border-radius-sm)","color":"var(--lia-bs-body-color)","hoverColor":"var(--lia-bs-body-color)","fontWeight":"var(--lia-font-weight-md)","fontSize":"var(--lia-font-size-xxs)","textTransform":"UPPERCASE","letterSpacing":"0.5px","__typename":"TagsThemeSettings"},"toasts":{"borderRadius":"var(--lia-bs-border-radius)","paddingX":"12px","__typename":"ToastsThemeSettings"},"typography":{"fontFamilyBase":"Segoe UI","fontStyleBase":"NORMAL","fontWeightBase":"400","fontWeightLight":"300","fontWeightNormal":"400","fontWeightMd":"500","fontWeightBold":"700","letterSpacingSm":"normal","letterSpacingXs":"normal","lineHeightBase":"1.5","fontSizeBase":"16px","fontSizeXxs":"11px","fontSizeXs":"12px","fontSizeSm":"14px","fontSizeLg":"20px","fontSizeXl":"24px","smallFontSize":"14px","customFonts":[{"source":"SERVER","name":"Segoe UI","styles":[{"style":"NORMAL","weight":"400","__typename":"FontStyleData"},{"style":"NORMAL","weight":"300","__typename":"FontStyleData"},{"style":"NORMAL","weight":"600","__typename":"FontStyleData"},{"style":"NORMAL","weight":"700","__typename":"FontStyleData"},{"style":"ITALIC","weight":"400","__typename":"FontStyleData"}],"assetNames":["SegoeUI-normal-400.woff2","SegoeUI-normal-300.woff2","SegoeUI-normal-600.woff2","SegoeUI-normal-700.woff2","SegoeUI-italic-400.woff2"],"__typename":"CustomFont"},{"source":"SERVER","name":"MWF Fluent Icons","styles":[{"style":"NORMAL","weight":"400","__typename":"FontStyleData"}],"assetNames":["MWFFluentIcons-normal-400.woff2"],"__typename":"CustomFont"}],"__typename":"TypographyThemeSettings"},"unstyledListItem":{"marginBottomSm":"5px","marginBottomMd":"10px","marginBottomLg":"15px","marginBottomXl":"20px","marginBottomXxl":"25px","__typename":"UnstyledListItemThemeSettings"},"yiq":{"light":"#ffffff","dark":"#000000","__typename":"YiqThemeSettings"},"colorLightness":{"primaryDark":0.36,"primaryLight":0.74,"primaryLighter":0.89,"primaryLightest":0.95,"infoDark":0.39,"infoLight":0.72,"infoLighter":0.85,"infoLightest":0.93,"successDark":0.24,"successLight":0.62,"successLighter":0.8,"successLightest":0.91,"warningDark":0.39,"warningLight":0.68,"warningLighter":0.84,"warningLightest":0.93,"dangerDark":0.41,"dangerLight":0.72,"dangerLighter":0.89,"dangerLightest":0.95,"__typename":"ColorLightnessThemeSettings"},"localOverride":false,"__typename":"Theme"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/common/Loading/LoadingDot-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/common/Loading/LoadingDot-1750857401000","value":{"title":"Loading..."},"localOverride":false},"CachedAsset:text:en_US-components/common/EmailVerification-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/common/EmailVerification-1750857401000","value":{"email.verification.title":"Email Verification Required","email.verification.message.update.email":"To participate in the community, you must first verify your email address. The verification email was sent to {email}. To change your email, visit My Settings.","email.verification.message.resend.email":"To participate in the community, you must first verify your email address. The verification email was sent to {email}. Resend email."},"localOverride":false},"CachedAsset:text:en_US-pages/tags/TagPage-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-pages/tags/TagPage-1750857401000","value":{"tagPageTitle":"Tag:\"{tagName}\" | {communityTitle}","tagPageForNodeTitle":"Tag:\"{tagName}\" in \"{title}\" | {communityTitle}","name":"Tags Page","tag":"Tag: {tagName}"},"localOverride":false},"Category:category:microsoft-security-product":{"__typename":"Category","id":"category:microsoft-security-product","entityType":"CATEGORY","displayId":"microsoft-security-product","nodeType":"category","depth":4,"title":"Microsoft Security","shortTitle":"Microsoft Security","parent":{"__ref":"Category:category:microsoft-security"}},"Category:category:top":{"__typename":"Category","id":"category:top","displayId":"top","nodeType":"category","depth":0,"title":"Top"},"Category:category:communities":{"__typename":"Category","id":"category:communities","displayId":"communities","nodeType":"category","depth":1,"parent":{"__ref":"Category:category:top"},"title":"Communities"},"Category:category:products-services":{"__typename":"Category","id":"category:products-services","displayId":"products-services","nodeType":"category","depth":2,"parent":{"__ref":"Category:category:communities"},"title":"Products"},"Category:category:microsoft-security":{"__typename":"Category","id":"category:microsoft-security","displayId":"microsoft-security","nodeType":"category","depth":3,"parent":{"__ref":"Category:category:products-services"},"title":"Microsoft Security","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Blog:board:microsoft-security-blog":{"__typename":"Blog","id":"board:microsoft-security-blog","entityType":"BLOG","displayId":"microsoft-security-blog","nodeType":"board","depth":5,"conversationStyle":"BLOG","title":"Microsoft Security Community Blog","description":"","avatar":null,"profileSettings":{"__typename":"ProfileSettings","language":null},"parent":{"__ref":"Category:category:microsoft-security-product"},"ancestors":{"__typename":"CoreNodeConnection","edges":[{"__typename":"CoreNodeEdge","node":{"__ref":"Community:community:gxcuf89792"}},{"__typename":"CoreNodeEdge","node":{"__ref":"Category:category:communities"}},{"__typename":"CoreNodeEdge","node":{"__ref":"Category:category:products-services"}},{"__typename":"CoreNodeEdge","node":{"__ref":"Category:category:microsoft-security"}},{"__typename":"CoreNodeEdge","node":{"__ref":"Category:category:microsoft-security-product"}}]},"userContext":{"__typename":"NodeUserContext","canAddAttachments":false,"canUpdateNode":false,"canPostMessages":false,"isSubscribed":false},"boardPolicies":{"__typename":"BoardPolicies","canPublishArticleOnCreate":{"__typename":"PolicyResult","failureReason":{"__typename":"FailureReason","message":"error.lithium.policies.forums.policy_can_publish_on_create_workflow_action.accessDenied","key":"error.lithium.policies.forums.policy_can_publish_on_create_workflow_action.accessDenied","args":[]}}},"theme":{"__ref":"Theme:customTheme1"},"shortTitle":"Microsoft Security Community Blog","tagPolicies":{"__typename":"TagPolicies","canSubscribeTagOnNode":{"__typename":"PolicyResult","failureReason":{"__typename":"FailureReason","message":"error.lithium.policies.labels.action.corenode.subscribe_labels.allow.accessDenied","key":"error.lithium.policies.labels.action.corenode.subscribe_labels.allow.accessDenied","args":[]}},"canManageTagDashboard":{"__typename":"PolicyResult","failureReason":{"__typename":"FailureReason","message":"error.lithium.policies.labels.action.corenode.admin_labels.allow.accessDenied","key":"error.lithium.policies.labels.action.corenode.admin_labels.allow.accessDenied","args":[]}}}},"CachedAsset:quilt:o365.prod:pages/tags/TagPage:board:microsoft-security-blog-1752222490453":{"__typename":"CachedAsset","id":"quilt:o365.prod:pages/tags/TagPage:board:microsoft-security-blog-1752222490453","value":{"id":"TagPage","container":{"id":"Common","headerProps":{"removeComponents":["community.widget.bannerWidget"],"__typename":"QuiltContainerSectionProps"},"items":[{"id":"tag-header-widget","layout":"ONE_COLUMN","bgColor":"var(--lia-bs-white)","showBorder":"BOTTOM","sectionEditLevel":"LOCKED","columnMap":{"main":[{"id":"tags.widget.TagsHeaderWidget","__typename":"QuiltComponent"}],"__typename":"OneSectionColumns"},"__typename":"OneColumnQuiltSection"},{"id":"messages-list-for-tag-widget","layout":"ONE_COLUMN","columnMap":{"main":[{"id":"messages.widget.messageListForNodeByRecentActivityWidget","props":{"viewVariant":{"type":"inline","props":{"useUnreadCount":true,"useViewCount":true,"useAuthorLogin":true,"clampBodyLines":3,"useAvatar":true,"useBoardIcon":false,"useKudosCount":true,"usePreviewMedia":true,"useTags":false,"useNode":true,"useNodeLink":true,"useTextBody":true,"truncateBodyLength":-1,"useBody":true,"useRepliesCount":true,"useSolvedBadge":true,"timeStampType":"conversation.lastPostingActivityTime","useMessageTimeLink":true,"clampSubjectLines":2}},"panelType":"divider","useTitle":false,"hideIfEmpty":false,"pagerVariant":{"type":"loadMore"},"style":"list","showTabs":true,"tabItemMap":{"default":{"mostRecent":true,"mostRecentUserContent":false,"newest":false},"additional":{"mostKudoed":true,"mostViewed":true,"mostReplies":false,"noReplies":false,"noSolutions":false,"solutions":false}}},"__typename":"QuiltComponent"}],"__typename":"OneSectionColumns"},"__typename":"OneColumnQuiltSection"}],"__typename":"QuiltContainer"},"__typename":"Quilt"},"localOverride":false},"CachedAsset:quiltWrapper:o365.prod:Common:1752222425355":{"__typename":"CachedAsset","id":"quiltWrapper:o365.prod:Common:1752222425355","value":{"id":"Common","header":{"backgroundImageProps":{"assetName":null,"backgroundSize":"COVER","backgroundRepeat":"NO_REPEAT","backgroundPosition":"CENTER_CENTER","lastModified":null,"__typename":"BackgroundImageProps"},"backgroundColor":"transparent","items":[{"id":"community.widget.navbarWidget","props":{"showUserName":true,"showRegisterLink":true,"useIconLanguagePicker":true,"useLabelLanguagePicker":true,"className":"QuiltComponent_lia-component-edit-mode__0nCcm","links":{"sideLinks":[],"mainLinks":[{"children":[],"linkType":"INTERNAL","id":"gxcuf89792","params":{},"routeName":"CommunityPage"},{"children":[],"linkType":"EXTERNAL","id":"external-link","url":"/Directory","target":"SELF"},{"children":[{"linkType":"INTERNAL","id":"microsoft365","params":{"categoryId":"microsoft365"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"windows","params":{"categoryId":"Windows"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"Common-microsoft365-copilot-link","params":{"categoryId":"Microsoft365Copilot"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"microsoft-teams","params":{"categoryId":"MicrosoftTeams"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"microsoft-securityand-compliance","params":{"categoryId":"microsoft-security"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"azure","params":{"categoryId":"Azure"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"Common-content_management-link","params":{"categoryId":"Content_Management"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"exchange","params":{"categoryId":"Exchange"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"windows-server","params":{"categoryId":"Windows-Server"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"outlook","params":{"categoryId":"Outlook"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"microsoft-endpoint-manager","params":{"categoryId":"microsoftintune"},"routeName":"CategoryPage"},{"linkType":"EXTERNAL","id":"external-link-2","url":"/Directory","target":"SELF"}],"linkType":"EXTERNAL","id":"communities","url":"/","target":"BLANK"},{"children":[{"linkType":"INTERNAL","id":"a-i","params":{"categoryId":"AI"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"education-sector","params":{"categoryId":"EducationSector"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"partner-community","params":{"categoryId":"PartnerCommunity"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"i-t-ops-talk","params":{"categoryId":"ITOpsTalk"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"healthcare-and-life-sciences","params":{"categoryId":"HealthcareAndLifeSciences"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"microsoft-mechanics","params":{"categoryId":"MicrosoftMechanics"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"public-sector","params":{"categoryId":"PublicSector"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"s-m-b","params":{"categoryId":"MicrosoftforNonprofits"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"io-t","params":{"categoryId":"IoT"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"startupsat-microsoft","params":{"categoryId":"StartupsatMicrosoft"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"driving-adoption","params":{"categoryId":"DrivingAdoption"},"routeName":"CategoryPage"},{"linkType":"EXTERNAL","id":"external-link-1","url":"/Directory","target":"SELF"}],"linkType":"EXTERNAL","id":"communities-1","url":"/","target":"SELF"},{"children":[],"linkType":"EXTERNAL","id":"external","url":"/Blogs","target":"SELF"},{"children":[],"linkType":"EXTERNAL","id":"external-1","url":"/Events","target":"SELF"},{"children":[{"linkType":"INTERNAL","id":"microsoft-learn-1","params":{"categoryId":"MicrosoftLearn"},"routeName":"CategoryPage"},{"linkType":"INTERNAL","id":"microsoft-learn-blog","params":{"boardId":"MicrosoftLearnBlog","categoryId":"MicrosoftLearn"},"routeName":"BlogBoardPage"},{"linkType":"EXTERNAL","id":"external-10","url":"/category/MicrosoftLearn?tab=grouphub","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-3","url":"https://docs.microsoft.com/learn/dynamics365/?WT.mc_id=techcom_header-webpage-m365","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-4","url":"https://docs.microsoft.com/learn/m365/?wt.mc_id=techcom_header-webpage-m365","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-5","url":"https://docs.microsoft.com/learn/topics/sci/?wt.mc_id=techcom_header-webpage-m365","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-6","url":"https://docs.microsoft.com/learn/powerplatform/?wt.mc_id=techcom_header-webpage-powerplatform","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-7","url":"https://docs.microsoft.com/learn/github/?wt.mc_id=techcom_header-webpage-github","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-8","url":"https://docs.microsoft.com/learn/teams/?wt.mc_id=techcom_header-webpage-teams","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-9","url":"https://docs.microsoft.com/learn/dotnet/?wt.mc_id=techcom_header-webpage-dotnet","target":"BLANK"},{"linkType":"EXTERNAL","id":"external-2","url":"https://docs.microsoft.com/learn/azure/?WT.mc_id=techcom_header-webpage-m365","target":"BLANK"}],"linkType":"INTERNAL","id":"microsoft-learn","params":{"categoryId":"MicrosoftLearn"},"routeName":"CategoryPage"},{"children":[],"linkType":"INTERNAL","id":"community-info-center","params":{"categoryId":"Community-Info-Center"},"routeName":"CategoryPage"}]},"style":{"boxShadow":"var(--lia-bs-box-shadow-sm)","controllerHighlightColor":"hsla(30, 100%, 50%)","linkFontWeight":"400","dropdownDividerMarginBottom":"10px","hamburgerBorderHover":"none","linkBoxShadowHover":"none","linkFontSize":"14px","backgroundOpacity":0.8,"controllerBorderRadius":"var(--lia-border-radius-50)","hamburgerBgColor":"transparent","hamburgerColor":"var(--lia-nav-controller-icon-color)","linkTextBorderBottom":"none","brandLogoHeight":"30px","linkBgHoverColor":"transparent","linkLetterSpacing":"normal","collapseMenuDividerOpacity":0.16,"dropdownPaddingBottom":"15px","paddingBottom":"15px","dropdownMenuOffset":"2px","hamburgerBgHoverColor":"transparent","borderBottom":"1px solid var(--lia-bs-border-color)","hamburgerBorder":"none","dropdownPaddingX":"10px","brandMarginRightSm":"10px","linkBoxShadow":"none","collapseMenuDividerBg":"var(--lia-nav-link-color)","linkColor":"var(--lia-bs-body-color)","linkJustifyContent":"flex-start","dropdownPaddingTop":"10px","controllerHighlightTextColor":"var(--lia-yiq-dark)","controllerTextColor":"var(--lia-nav-controller-icon-color)","background":{"imageAssetName":"","color":"var(--lia-bs-white)","size":"COVER","repeat":"NO_REPEAT","position":"CENTER_CENTER","imageLastModified":""},"linkBorderRadius":"var(--lia-bs-border-radius-sm)","linkHoverColor":"var(--lia-bs-body-color)","position":"FIXED","linkBorder":"none","linkTextBorderBottomHover":"2px solid var(--lia-bs-body-color)","brandMarginRight":"30px","hamburgerHoverColor":"var(--lia-nav-controller-icon-color)","linkBorderHover":"none","collapseMenuMarginLeft":"20px","linkFontStyle":"NORMAL","controllerTextHoverColor":"var(--lia-nav-controller-icon-hover-color)","linkPaddingX":"10px","linkPaddingY":"5px","paddingTop":"15px","linkTextTransform":"NONE","dropdownBorderColor":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.08)","controllerBgHoverColor":"hsla(var(--lia-bs-black-h), var(--lia-bs-black-s), var(--lia-bs-black-l), 0.1)","linkBgColor":"transparent","linkDropdownPaddingX":"var(--lia-nav-link-px)","linkDropdownPaddingY":"9px","controllerIconColor":"var(--lia-bs-body-color)","dropdownDividerMarginTop":"10px","linkGap":"10px","controllerIconHoverColor":"var(--lia-bs-body-color)"},"showSearchIcon":false,"languagePickerStyle":"iconAndLabel"},"__typename":"QuiltComponent"},{"id":"community.widget.breadcrumbWidget","props":{"backgroundColor":"transparent","linkHighlightColor":"var(--lia-bs-primary)","visualEffects":{"showBottomBorder":true},"linkTextColor":"var(--lia-bs-gray-700)"},"__typename":"QuiltComponent"},{"id":"custom.widget.CommunityBanner","props":{"widgetVisibility":"signedInOrAnonymous","useTitle":true,"usePageWidth":false,"useBackground":false,"title":"","lazyLoad":false},"__typename":"QuiltComponent"},{"id":"custom.widget.HeroBanner","props":{"widgetVisibility":"signedInOrAnonymous","usePageWidth":false,"useTitle":true,"cMax_items":3,"useBackground":false,"title":"","lazyLoad":false,"widgetChooser":"custom.widget.HeroBanner"},"__typename":"QuiltComponent"}],"__typename":"QuiltWrapperSection"},"footer":{"backgroundImageProps":{"assetName":null,"backgroundSize":"COVER","backgroundRepeat":"NO_REPEAT","backgroundPosition":"CENTER_CENTER","lastModified":null,"__typename":"BackgroundImageProps"},"backgroundColor":"transparent","items":[{"id":"custom.widget.MicrosoftFooter","props":{"widgetVisibility":"signedInOrAnonymous","useTitle":true,"useBackground":false,"title":"","lazyLoad":false},"__typename":"QuiltComponent"}],"__typename":"QuiltWrapperSection"},"__typename":"QuiltWrapper","localOverride":false},"localOverride":false},"CachedAsset:text:en_US-components/common/ActionFeedback-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/common/ActionFeedback-1750857401000","value":{"joinedGroupHub.title":"Welcome","joinedGroupHub.message":"You are now a member of this group and are subscribed to updates.","groupHubInviteNotFound.title":"Invitation Not Found","groupHubInviteNotFound.message":"Sorry, we could not find your invitation to the group. The owner may have canceled the invite.","groupHubNotFound.title":"Group Not Found","groupHubNotFound.message":"The grouphub you tried to join does not exist. It may have been deleted.","existingGroupHubMember.title":"Already Joined","existingGroupHubMember.message":"You are already a member of this group.","accountLocked.title":"Account Locked","accountLocked.message":"Your account has been locked due to multiple failed attempts. Try again in {lockoutTime} minutes.","editedGroupHub.title":"Changes Saved","editedGroupHub.message":"Your group has been updated.","leftGroupHub.title":"Goodbye","leftGroupHub.message":"You are no longer a member of this group and will not receive future updates.","deletedGroupHub.title":"Deleted","deletedGroupHub.message":"The group has been deleted.","groupHubCreated.title":"Group Created","groupHubCreated.message":"{groupHubName} is ready to use","accountClosed.title":"Account Closed","accountClosed.message":"The account has been closed and you will now be redirected to the homepage","resetTokenExpired.title":"Reset Password Link has Expired","resetTokenExpired.message":"Try resetting your password again","invalidUrl.title":"Invalid URL","invalidUrl.message":"The URL you're using is not recognized. Verify your URL and try again.","accountClosedForUser.title":"Account Closed","accountClosedForUser.message":"{userName}'s account is closed","inviteTokenInvalid.title":"Invitation Invalid","inviteTokenInvalid.message":"Your invitation to the community has been canceled or expired.","inviteTokenError.title":"Invitation Verification Failed","inviteTokenError.message":"The url you are utilizing is not recognized. Verify your URL and try again","pageNotFound.title":"Access Denied","pageNotFound.message":"You do not have access to this area of the community or it doesn't exist","eventAttending.title":"Responded as Attending","eventAttending.message":"You'll be notified when there's new activity and reminded as the event approaches","eventInterested.title":"Responded as Interested","eventInterested.message":"You'll be notified when there's new activity and reminded as the event approaches","eventNotFound.title":"Event Not Found","eventNotFound.message":"The event you tried to respond to does not exist.","redirectToRelatedPage.title":"Showing Related Content","redirectToRelatedPageForBaseUsers.title":"Showing Related Content","redirectToRelatedPageForBaseUsers.message":"The content you are trying to access is archived","redirectToRelatedPage.message":"The content you are trying to access is archived","relatedUrl.archivalLink.flyoutMessage":"The content you are trying to access is archived View Archived Content"},"localOverride":false},"CachedAsset:component:custom.widget.CommunityBanner-en-us-1752222535220":{"__typename":"CachedAsset","id":"component:custom.widget.CommunityBanner-en-us-1752222535220","value":{"component":{"id":"custom.widget.CommunityBanner","template":{"id":"CommunityBanner","markupLanguage":"REACT","style":null,"texts":{},"defaults":{"config":{"applicablePages":[],"description":null,"fetchedContent":null,"__typename":"ComponentConfiguration"},"props":[],"__typename":"ComponentProperties"},"components":[{"id":"custom.widget.CommunityBanner","form":null,"config":null,"props":[],"__typename":"Component"}],"grouping":"CUSTOM","__typename":"ComponentTemplate"},"properties":{"config":{"applicablePages":[],"description":null,"fetchedContent":null,"__typename":"ComponentConfiguration"},"props":[],"__typename":"ComponentProperties"},"form":null,"__typename":"Component","localOverride":false},"globalCss":null,"form":null},"localOverride":false},"CachedAsset:component:custom.widget.HeroBanner-en-us-1752222535220":{"__typename":"CachedAsset","id":"component:custom.widget.HeroBanner-en-us-1752222535220","value":{"component":{"id":"custom.widget.HeroBanner","template":{"id":"HeroBanner","markupLanguage":"REACT","style":null,"texts":{"searchPlaceholderText":"Search this community","followActionText":"Follow","unfollowActionText":"Following","searchOnHoverText":"Please enter your search term(s) and then press return key to complete a search.","blogs.sidebar.pagetitle":"Latest Blogs | Microsoft Tech Community","followThisNode":"Follow this node","unfollowThisNode":"Unfollow this node"},"defaults":{"config":{"applicablePages":[],"description":null,"fetchedContent":null,"__typename":"ComponentConfiguration"},"props":[{"id":"max_items","dataType":"NUMBER","list":false,"defaultValue":"3","label":"Max Items","description":"The maximum number of items to display in the carousel","possibleValues":null,"control":"INPUT","__typename":"PropDefinition"}],"__typename":"ComponentProperties"},"components":[{"id":"custom.widget.HeroBanner","form":{"fields":[{"id":"widgetChooser","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"title","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"useTitle","validation":null,"noValidation":null,"dataType":"BOOLEAN","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"useBackground","validation":null,"noValidation":null,"dataType":"BOOLEAN","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"widgetVisibility","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"moreOptions","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"cMax_items","validation":null,"noValidation":null,"dataType":"NUMBER","list":false,"control":"INPUT","defaultValue":"3","label":"Max Items","description":"The maximum number of items to display in the carousel","possibleValues":null,"__typename":"FormField"}],"layout":{"rows":[{"id":"widgetChooserGroup","type":"fieldset","as":null,"items":[{"id":"widgetChooser","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"titleGroup","type":"fieldset","as":null,"items":[{"id":"title","className":null,"__typename":"FormFieldRef"},{"id":"useTitle","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"useBackground","type":"fieldset","as":null,"items":[{"id":"useBackground","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"widgetVisibility","type":"fieldset","as":null,"items":[{"id":"widgetVisibility","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"moreOptionsGroup","type":"fieldset","as":null,"items":[{"id":"moreOptions","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"componentPropsGroup","type":"fieldset","as":null,"items":[{"id":"cMax_items","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"}],"actionButtons":null,"className":"custom_widget_HeroBanner_form","formGroupFieldSeparator":"divider","__typename":"FormLayout"},"__typename":"Form"},"config":null,"props":[],"__typename":"Component"}],"grouping":"CUSTOM","__typename":"ComponentTemplate"},"properties":{"config":{"applicablePages":[],"description":null,"fetchedContent":null,"__typename":"ComponentConfiguration"},"props":[{"id":"max_items","dataType":"NUMBER","list":false,"defaultValue":"3","label":"Max Items","description":"The maximum number of items to display in the carousel","possibleValues":null,"control":"INPUT","__typename":"PropDefinition"}],"__typename":"ComponentProperties"},"form":{"fields":[{"id":"widgetChooser","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"title","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"useTitle","validation":null,"noValidation":null,"dataType":"BOOLEAN","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"useBackground","validation":null,"noValidation":null,"dataType":"BOOLEAN","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"widgetVisibility","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"moreOptions","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"cMax_items","validation":null,"noValidation":null,"dataType":"NUMBER","list":false,"control":"INPUT","defaultValue":"3","label":"Max Items","description":"The maximum number of items to display in the carousel","possibleValues":null,"__typename":"FormField"}],"layout":{"rows":[{"id":"widgetChooserGroup","type":"fieldset","as":null,"items":[{"id":"widgetChooser","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"titleGroup","type":"fieldset","as":null,"items":[{"id":"title","className":null,"__typename":"FormFieldRef"},{"id":"useTitle","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"useBackground","type":"fieldset","as":null,"items":[{"id":"useBackground","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"widgetVisibility","type":"fieldset","as":null,"items":[{"id":"widgetVisibility","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"moreOptionsGroup","type":"fieldset","as":null,"items":[{"id":"moreOptions","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"componentPropsGroup","type":"fieldset","as":null,"items":[{"id":"cMax_items","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"}],"actionButtons":null,"className":"custom_widget_HeroBanner_form","formGroupFieldSeparator":"divider","__typename":"FormLayout"},"__typename":"Form"},"__typename":"Component","localOverride":false},"globalCss":null,"form":{"fields":[{"id":"widgetChooser","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"title","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"useTitle","validation":null,"noValidation":null,"dataType":"BOOLEAN","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"useBackground","validation":null,"noValidation":null,"dataType":"BOOLEAN","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"widgetVisibility","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"moreOptions","validation":null,"noValidation":null,"dataType":"STRING","list":null,"control":null,"defaultValue":null,"label":null,"description":null,"possibleValues":null,"__typename":"FormField"},{"id":"cMax_items","validation":null,"noValidation":null,"dataType":"NUMBER","list":false,"control":"INPUT","defaultValue":"3","label":"Max Items","description":"The maximum number of items to display in the carousel","possibleValues":null,"__typename":"FormField"}],"layout":{"rows":[{"id":"widgetChooserGroup","type":"fieldset","as":null,"items":[{"id":"widgetChooser","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"titleGroup","type":"fieldset","as":null,"items":[{"id":"title","className":null,"__typename":"FormFieldRef"},{"id":"useTitle","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"useBackground","type":"fieldset","as":null,"items":[{"id":"useBackground","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"widgetVisibility","type":"fieldset","as":null,"items":[{"id":"widgetVisibility","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"moreOptionsGroup","type":"fieldset","as":null,"items":[{"id":"moreOptions","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"},{"id":"componentPropsGroup","type":"fieldset","as":null,"items":[{"id":"cMax_items","className":null,"__typename":"FormFieldRef"}],"props":null,"legend":null,"description":null,"className":null,"viewVariant":null,"toggleState":null,"__typename":"FormFieldset"}],"actionButtons":null,"className":"custom_widget_HeroBanner_form","formGroupFieldSeparator":"divider","__typename":"FormLayout"},"__typename":"Form"}},"localOverride":false},"CachedAsset:component:custom.widget.MicrosoftFooter-en-us-1752222535220":{"__typename":"CachedAsset","id":"component:custom.widget.MicrosoftFooter-en-us-1752222535220","value":{"component":{"id":"custom.widget.MicrosoftFooter","template":{"id":"MicrosoftFooter","markupLanguage":"HANDLEBARS","style":".context-uhf {\r\n min-width: 280px;\r\n font-size: 15px;\r\n box-sizing: border-box;\r\n -ms-text-size-adjust: 100%;\r\n -webkit-text-size-adjust: 100%;\r\n & *,\r\n & *:before,\r\n & *:after {\r\n box-sizing: inherit;\r\n }\r\n a.c-uhff-link {\r\n color: #616161;\r\n word-break: break-word;\r\n text-decoration: none;\r\n }\r\n &a:link,\r\n &a:focus,\r\n &a:hover,\r\n &a:active,\r\n &a:visited {\r\n text-decoration: none;\r\n color: inherit;\r\n }\r\n & div {\r\n font-family: 'Segoe UI', SegoeUI, 'Helvetica Neue', Helvetica, Arial, sans-serif;\r\n }\r\n}\r\n.c-uhff {\r\n background: #f2f2f2;\r\n margin: -1.5625;\r\n width: auto;\r\n height: auto;\r\n}\r\n.c-uhff-nav {\r\n margin: 0 auto;\r\n max-width: calc(1600px + 10%);\r\n padding: 0 5%;\r\n box-sizing: inherit;\r\n &:before,\r\n &:after {\r\n content: ' ';\r\n display: table;\r\n clear: left;\r\n }\r\n @media only screen and (max-width: 1083px) {\r\n padding-left: 12px;\r\n }\r\n .c-heading-4 {\r\n color: #616161;\r\n word-break: break-word;\r\n font-size: 15px;\r\n line-height: 20px;\r\n padding: 36px 0 4px;\r\n font-weight: 600;\r\n }\r\n .c-uhff-nav-row {\r\n .c-uhff-nav-group {\r\n display: block;\r\n float: left;\r\n min-height: 1px;\r\n vertical-align: text-top;\r\n padding: 0 12px;\r\n width: 100%;\r\n zoom: 1;\r\n &:first-child {\r\n padding-left: 0;\r\n @media only screen and (max-width: 1083px) {\r\n padding-left: 12px;\r\n }\r\n }\r\n @media only screen and (min-width: 540px) and (max-width: 1082px) {\r\n width: 33.33333%;\r\n }\r\n @media only screen and (min-width: 1083px) {\r\n width: 16.6666666667%;\r\n }\r\n ul.c-list.f-bare {\r\n font-size: 11px;\r\n line-height: 16px;\r\n margin-top: 0;\r\n margin-bottom: 0;\r\n padding-left: 0;\r\n list-style-type: none;\r\n li {\r\n word-break: break-word;\r\n padding: 8px 0;\r\n margin: 0;\r\n }\r\n }\r\n }\r\n }\r\n}\r\n.c-uhff-base {\r\n background: #f2f2f2;\r\n margin: 0 auto;\r\n max-width: calc(1600px + 10%);\r\n padding: 30px 5% 16px;\r\n &:before,\r\n &:after {\r\n content: ' ';\r\n display: table;\r\n }\r\n &:after {\r\n clear: both;\r\n }\r\n a.c-uhff-ccpa {\r\n font-size: 11px;\r\n line-height: 16px;\r\n float: left;\r\n margin: 3px 0;\r\n }\r\n a.c-uhff-ccpa:hover {\r\n text-decoration: underline;\r\n }\r\n ul.c-list {\r\n font-size: 11px;\r\n line-height: 16px;\r\n float: right;\r\n margin: 3px 0;\r\n color: #616161;\r\n li {\r\n padding: 0 24px 4px 0;\r\n display: inline-block;\r\n }\r\n }\r\n .c-list.f-bare {\r\n padding-left: 0;\r\n list-style-type: none;\r\n }\r\n @media only screen and (max-width: 1083px) {\r\n display: flex;\r\n flex-wrap: wrap;\r\n padding: 30px 24px 16px;\r\n }\r\n}\r\n\r\n.social-share {\r\n position: fixed;\r\n top: 60%;\r\n transform: translateY(-50%);\r\n left: 0;\r\n z-index: 1000;\r\n}\r\n\r\n.sharing-options {\r\n list-style: none;\r\n padding: 0;\r\n margin: 0;\r\n display: block;\r\n flex-direction: column;\r\n background-color: white;\r\n width: 50px;\r\n border-radius: 0px 7px 7px 0px;\r\n}\r\n.linkedin-icon {\r\n border-top-right-radius: 7px;\r\n}\r\n.linkedin-icon:hover {\r\n border-radius: 0;\r\n}\r\n\r\n.social-share-email-image:hover {\r\n border-radius: 0;\r\n}\r\n\r\n.social-link-footer:hover .linkedin-icon {\r\n border-radius: 0;\r\n}\r\n.social-link-footer:hover .social-share-email-image {\r\n border-radius: 0;\r\n}\r\n\r\n.social-link-footer img {\r\n width: 30px;\r\n height: auto;\r\n transition: filter 0.3s ease;\r\n}\r\n\r\n.social-share-list {\r\n width: 50px;\r\n}\r\n.social-share-rss-image {\r\n width: 30px;\r\n height: auto;\r\n transition: filter 0.3s ease;\r\n}\r\n.sharing-options li {\r\n width: 50px;\r\n height: 50px;\r\n padding: 8px;\r\n box-sizing: border-box;\r\n border: 2px solid white;\r\n display: inline-block;\r\n text-align: center;\r\n opacity: 1;\r\n visibility: visible;\r\n transition: border 0.3s ease; /* Smooth transition effect */\r\n border-left: none;\r\n border-bottom: none; /* Apply bottom border to only last item */\r\n}\r\n\r\n.social-share-list-linkedin {\r\n background-color: #0474b4;\r\n border-top-right-radius: 5px; /* Rounded top right corner of first item*/\r\n}\r\n.social-share-list-facebook {\r\n background-color: #3c5c9c;\r\n}\r\n.social-share-list-xicon {\r\n background-color: #000;\r\n}\r\n.social-share-list-reddit {\r\n background-color: #fc4404;\r\n}\r\n.social-share-list-bluesky {\r\n background-color: #f0f2f5;\r\n}\r\n.social-share-list-rss {\r\n background-color: #ec7b1c;\r\n}\r\n.social-share-list-mail {\r\n background-color: #848484;\r\n border-bottom-right-radius: 5px; /* Rounded bottom right corner of last item*/\r\n}\r\n.sharing-options li.social-share-list-mail {\r\n border-bottom: 2px solid white; /* Add bottom border only to the last item */\r\n height: 52px; /* Increase last child height to make in align with the hover label */\r\n}\r\n.x-icon {\r\n filter: invert(100%);\r\n transition: filter 0.3s ease;\r\n width: 20px !important;\r\n height: auto;\r\n padding-top: 5px !important;\r\n}\r\n.bluesky-icon {\r\n filter: invert(20%) sepia(100%) saturate(3000%) hue-rotate(180deg);\r\n transition: filter 0.3s ease;\r\n padding-top: 5px !important;\r\n width: 25px !important;\r\n}\r\n\r\n.share-icon {\r\n border: 2px solid transparent;\r\n display: inline-block;\r\n position: relative;\r\n}\r\n\r\n.sharing-options li:hover {\r\n border: 2px solid white;\r\n border-left: none;\r\n border-bottom: none;\r\n border-radius: 0px;\r\n}\r\n.sharing-options li.social-share-list-mail:hover {\r\n border-bottom: 2px solid white; /* Add bottom border only to the last item */\r\n}\r\n\r\n.sharing-options li:hover .label {\r\n opacity: 1;\r\n visibility: visible;\r\n border: 2px solid white;\r\n box-sizing: border-box;\r\n border-left: none;\r\n}\r\n\r\n.label {\r\n position: absolute;\r\n left: 100%;\r\n white-space: nowrap;\r\n opacity: 0;\r\n visibility: hidden;\r\n transition: all 0.2s ease;\r\n color: white;\r\n border-radius: 0 10 0 10px;\r\n top: 50%;\r\n transform: translateY(-50%);\r\n height: 52px;\r\n display: flex;\r\n align-items: center;\r\n justify-content: center;\r\n padding: 10px 12px 15px 8px;\r\n border: 2px solid white;\r\n}\r\n.linkedin {\r\n background-color: #0474b4;\r\n border-top-right-radius: 5px; /* Rounded top right corner of first item*/\r\n}\r\n.facebook {\r\n background-color: #3c5c9c;\r\n}\r\n.twitter {\r\n background-color: black;\r\n color: white;\r\n}\r\n.reddit {\r\n background-color: #fc4404;\r\n}\r\n.mail {\r\n background-color: #848484;\r\n border-bottom-right-radius: 5px; /* Rounded bottom right corner of last item*/\r\n}\r\n.bluesky {\r\n background-color: #f0f2f5;\r\n color: black;\r\n}\r\n.rss {\r\n background-color: #ec7b1c;\r\n}\r\n\r\n@media (max-width: 991px) {\r\n .social-share {\r\n display: none;\r\n }\r\n}\r\n","texts":{"New tab":"What's New","New 1":"Surface Laptop Studio 2","New 2":"Surface Laptop Go 3","New 3":"Surface Pro 9","New 4":"Surface Laptop 5","New 5":"Surface Studio 2+","New 6":"Copilot in Windows","New 7":"Microsoft 365","New 8":"Windows 11 apps","Store tab":"Microsoft Store","Store 1":"Account Profile","Store 2":"Download Center","Store 3":"Microsoft Store Support","Store 4":"Returns","Store 5":"Order tracking","Store 6":"Certified Refurbished","Store 7":"Microsoft Store Promise","Store 8":"Flexible Payments","Education tab":"Education","Edu 1":"Microsoft in education","Edu 2":"Devices for education","Edu 3":"Microsoft Teams for Education","Edu 4":"Microsoft 365 Education","Edu 5":"How to buy for your school","Edu 6":"Educator Training and development","Edu 7":"Deals for students and parents","Edu 8":"Azure for students","Business tab":"Business","Bus 1":"Microsoft Cloud","Bus 2":"Microsoft Security","Bus 3":"Dynamics 365","Bus 4":"Microsoft 365","Bus 5":"Microsoft Power Platform","Bus 6":"Microsoft Teams","Bus 7":"Microsoft Industry","Bus 8":"Small Business","Developer tab":"Developer & IT","Dev 1":"Azure","Dev 2":"Developer Center","Dev 3":"Documentation","Dev 4":"Microsoft Learn","Dev 5":"Microsoft Tech Community","Dev 6":"Azure Marketplace","Dev 7":"AppSource","Dev 8":"Visual Studio","Company tab":"Company","Com 1":"Careers","Com 2":"About Microsoft","Com 3":"Company News","Com 4":"Privacy at Microsoft","Com 5":"Investors","Com 6":"Diversity and inclusion","Com 7":"Accessiblity","Com 8":"Sustainibility"},"defaults":{"config":{"applicablePages":[],"description":"The Microsoft Footer","fetchedContent":null,"__typename":"ComponentConfiguration"},"props":[],"__typename":"ComponentProperties"},"components":[{"id":"custom.widget.MicrosoftFooter","form":null,"config":null,"props":[],"__typename":"Component"}],"grouping":"CUSTOM","__typename":"ComponentTemplate"},"properties":{"config":{"applicablePages":[],"description":"The Microsoft Footer","fetchedContent":null,"__typename":"ComponentConfiguration"},"props":[],"__typename":"ComponentProperties"},"form":null,"__typename":"Component","localOverride":false},"globalCss":{"css":".custom_widget_MicrosoftFooter_context-uhf_1w55e_1 {\r\n min-width: 17.5rem;\r\n font-size: 0.9375rem;\r\n box-sizing: border-box;\r\n -ms-text-size-adjust: 100%;\r\n -webkit-text-size-adjust: 100%;\r\n & *,\r\n & *:before,\r\n & *:after {\r\n box-sizing: inherit;\r\n }\r\n a.custom_widget_MicrosoftFooter_c-uhff-link_1w55e_23 {\r\n color: #616161;\r\n word-break: break-word;\r\n text-decoration: none;\r\n }\r\n &a:link,\r\n &a:focus,\r\n &a:hover,\r\n &a:active,\r\n &a:visited {\r\n text-decoration: none;\r\n color: inherit;\r\n }\r\n & div {\r\n font-family: 'Segoe UI', SegoeUI, 'Helvetica Neue', Helvetica, Arial, sans-serif;\r\n }\r\n}\r\n.custom_widget_MicrosoftFooter_c-uhff_1w55e_23 {\r\n background: #f2f2f2;\r\n margin: -1.5625;\r\n width: auto;\r\n height: auto;\r\n}\r\n.custom_widget_MicrosoftFooter_c-uhff-nav_1w55e_69 {\r\n margin: 0 auto;\r\n max-width: calc(100rem + 10%);\r\n padding: 0 5%;\r\n box-sizing: inherit;\r\n &:before,\r\n &:after {\r\n content: ' ';\r\n display: table;\r\n clear: left;\r\n }\r\n @media only screen and (max-width: 1083px) {\r\n padding-left: 0.75rem;\r\n }\r\n .custom_widget_MicrosoftFooter_c-heading-4_1w55e_97 {\r\n color: #616161;\r\n word-break: break-word;\r\n font-size: 0.9375rem;\r\n line-height: 1.25rem;\r\n padding: 2.25rem 0 0.25rem;\r\n font-weight: 600;\r\n }\r\n .custom_widget_MicrosoftFooter_c-uhff-nav-row_1w55e_113 {\r\n .custom_widget_MicrosoftFooter_c-uhff-nav-group_1w55e_115 {\r\n display: block;\r\n float: left;\r\n min-height: 0.0625rem;\r\n vertical-align: text-top;\r\n padding: 0 0.75rem;\r\n width: 100%;\r\n zoom: 1;\r\n &:first-child {\r\n padding-left: 0;\r\n @media only screen and (max-width: 1083px) {\r\n padding-left: 0.75rem;\r\n }\r\n }\r\n @media only screen and (min-width: 540px) and (max-width: 1082px) {\r\n width: 33.33333%;\r\n }\r\n @media only screen and (min-width: 1083px) {\r\n width: 16.6666666667%;\r\n }\r\n ul.custom_widget_MicrosoftFooter_c-list_1w55e_155.custom_widget_MicrosoftFooter_f-bare_1w55e_155 {\r\n font-size: 0.6875rem;\r\n line-height: 1rem;\r\n margin-top: 0;\r\n margin-bottom: 0;\r\n padding-left: 0;\r\n list-style-type: none;\r\n li {\r\n word-break: break-word;\r\n padding: 0.5rem 0;\r\n margin: 0;\r\n }\r\n }\r\n }\r\n }\r\n}\r\n.custom_widget_MicrosoftFooter_c-uhff-base_1w55e_187 {\r\n background: #f2f2f2;\r\n margin: 0 auto;\r\n max-width: calc(100rem + 10%);\r\n padding: 1.875rem 5% 1rem;\r\n &:before,\r\n &:after {\r\n content: ' ';\r\n display: table;\r\n }\r\n &:after {\r\n clear: both;\r\n }\r\n a.custom_widget_MicrosoftFooter_c-uhff-ccpa_1w55e_213 {\r\n font-size: 0.6875rem;\r\n line-height: 1rem;\r\n float: left;\r\n margin: 0.1875rem 0;\r\n }\r\n a.custom_widget_MicrosoftFooter_c-uhff-ccpa_1w55e_213:hover {\r\n text-decoration: underline;\r\n }\r\n ul.custom_widget_MicrosoftFooter_c-list_1w55e_155 {\r\n font-size: 0.6875rem;\r\n line-height: 1rem;\r\n float: right;\r\n margin: 0.1875rem 0;\r\n color: #616161;\r\n li {\r\n padding: 0 1.5rem 0.25rem 0;\r\n display: inline-block;\r\n }\r\n }\r\n .custom_widget_MicrosoftFooter_c-list_1w55e_155.custom_widget_MicrosoftFooter_f-bare_1w55e_155 {\r\n padding-left: 0;\r\n list-style-type: none;\r\n }\r\n @media only screen and (max-width: 1083px) {\r\n display: flex;\r\n flex-wrap: wrap;\r\n padding: 1.875rem 1.5rem 1rem;\r\n }\r\n}\r\n.custom_widget_MicrosoftFooter_social-share_1w55e_275 {\r\n position: fixed;\r\n top: 60%;\r\n transform: translateY(-50%);\r\n left: 0;\r\n z-index: 1000;\r\n}\r\n.custom_widget_MicrosoftFooter_sharing-options_1w55e_291 {\r\n list-style: none;\r\n padding: 0;\r\n margin: 0;\r\n display: block;\r\n flex-direction: column;\r\n background-color: white;\r\n width: 3.125rem;\r\n border-radius: 0 0.4375rem 0.4375rem 0;\r\n}\r\n.custom_widget_MicrosoftFooter_linkedin-icon_1w55e_311 {\r\n border-top-right-radius: 7px;\r\n}\r\n.custom_widget_MicrosoftFooter_linkedin-icon_1w55e_311:hover {\r\n border-radius: 0;\r\n}\r\n.custom_widget_MicrosoftFooter_social-share-email-image_1w55e_325:hover {\r\n border-radius: 0;\r\n}\r\n.custom_widget_MicrosoftFooter_social-link-footer_1w55e_333:hover .custom_widget_MicrosoftFooter_linkedin-icon_1w55e_311 {\r\n border-radius: 0;\r\n}\r\n.custom_widget_MicrosoftFooter_social-link-footer_1w55e_333:hover .custom_widget_MicrosoftFooter_social-share-email-image_1w55e_325 {\r\n border-radius: 0;\r\n}\r\n.custom_widget_MicrosoftFooter_social-link-footer_1w55e_333 img {\r\n width: 1.875rem;\r\n height: auto;\r\n transition: filter 0.3s ease;\r\n}\r\n.custom_widget_MicrosoftFooter_social-share-list_1w55e_359 {\r\n width: 3.125rem;\r\n}\r\n.custom_widget_MicrosoftFooter_social-share-rss-image_1w55e_365 {\r\n width: 1.875rem;\r\n height: auto;\r\n transition: filter 0.3s ease;\r\n}\r\n.custom_widget_MicrosoftFooter_sharing-options_1w55e_291 li {\r\n width: 3.125rem;\r\n height: 3.125rem;\r\n padding: 0.5rem;\r\n box-sizing: border-box;\r\n border: 2px solid white;\r\n display: inline-block;\r\n text-align: center;\r\n opacity: 1;\r\n visibility: visible;\r\n transition: border 0.3s ease; /* Smooth transition effect */\r\n border-left: none;\r\n border-bottom: none; /* Apply bottom border to only last item */\r\n}\r\n.custom_widget_MicrosoftFooter_social-share-list-linkedin_1w55e_405 {\r\n background-color: #0474b4;\r\n border-top-right-radius: 5px; /* Rounded top right corner of first item*/\r\n}\r\n.custom_widget_MicrosoftFooter_social-share-list-facebook_1w55e_413 {\r\n background-color: #3c5c9c;\r\n}\r\n.custom_widget_MicrosoftFooter_social-share-list-xicon_1w55e_419 {\r\n background-color: #000;\r\n}\r\n.custom_widget_MicrosoftFooter_social-share-list-reddit_1w55e_425 {\r\n background-color: #fc4404;\r\n}\r\n.custom_widget_MicrosoftFooter_social-share-list-bluesky_1w55e_431 {\r\n background-color: #f0f2f5;\r\n}\r\n.custom_widget_MicrosoftFooter_social-share-list-rss_1w55e_437 {\r\n background-color: #ec7b1c;\r\n}\r\n.custom_widget_MicrosoftFooter_social-share-list-mail_1w55e_443 {\r\n background-color: #848484;\r\n border-bottom-right-radius: 5px; /* Rounded bottom right corner of last item*/\r\n}\r\n.custom_widget_MicrosoftFooter_sharing-options_1w55e_291 li.custom_widget_MicrosoftFooter_social-share-list-mail_1w55e_443 {\r\n border-bottom: 2px solid white; /* Add bottom border only to the last item */\r\n height: 3.25rem; /* Increase last child height to make in align with the hover label */\r\n}\r\n.custom_widget_MicrosoftFooter_x-icon_1w55e_459 {\r\n filter: invert(100%);\r\n transition: filter 0.3s ease;\r\n width: 1.25rem !important;\r\n height: auto;\r\n padding-top: 0.3125rem !important;\r\n}\r\n.custom_widget_MicrosoftFooter_bluesky-icon_1w55e_473 {\r\n filter: invert(20%) sepia(100%) saturate(3000%) hue-rotate(180deg);\r\n transition: filter 0.3s ease;\r\n padding-top: 0.3125rem !important;\r\n width: 1.5625rem !important;\r\n}\r\n.custom_widget_MicrosoftFooter_share-icon_1w55e_487 {\r\n border: 2px solid transparent;\r\n display: inline-block;\r\n position: relative;\r\n}\r\n.custom_widget_MicrosoftFooter_sharing-options_1w55e_291 li:hover {\r\n border: 2px solid white;\r\n border-left: none;\r\n border-bottom: none;\r\n border-radius: 0;\r\n}\r\n.custom_widget_MicrosoftFooter_sharing-options_1w55e_291 li.custom_widget_MicrosoftFooter_social-share-list-mail_1w55e_443:hover {\r\n border-bottom: 2px solid white; /* Add bottom border only to the last item */\r\n}\r\n.custom_widget_MicrosoftFooter_sharing-options_1w55e_291 li:hover .custom_widget_MicrosoftFooter_label_1w55e_519 {\r\n opacity: 1;\r\n visibility: visible;\r\n border: 2px solid white;\r\n box-sizing: border-box;\r\n border-left: none;\r\n}\r\n.custom_widget_MicrosoftFooter_label_1w55e_519 {\r\n position: absolute;\r\n left: 100%;\r\n white-space: nowrap;\r\n opacity: 0;\r\n visibility: hidden;\r\n transition: all 0.2s ease;\r\n color: white;\r\n border-radius: 0 10 0 0.625rem;\r\n top: 50%;\r\n transform: translateY(-50%);\r\n height: 3.25rem;\r\n display: flex;\r\n align-items: center;\r\n justify-content: center;\r\n padding: 0.625rem 0.75rem 0.9375rem 0.5rem;\r\n border: 2px solid white;\r\n}\r\n.custom_widget_MicrosoftFooter_linkedin_1w55e_311 {\r\n background-color: #0474b4;\r\n border-top-right-radius: 5px; /* Rounded top right corner of first item*/\r\n}\r\n.custom_widget_MicrosoftFooter_facebook_1w55e_579 {\r\n background-color: #3c5c9c;\r\n}\r\n.custom_widget_MicrosoftFooter_twitter_1w55e_585 {\r\n background-color: black;\r\n color: white;\r\n}\r\n.custom_widget_MicrosoftFooter_reddit_1w55e_593 {\r\n background-color: #fc4404;\r\n}\r\n.custom_widget_MicrosoftFooter_mail_1w55e_599 {\r\n background-color: #848484;\r\n border-bottom-right-radius: 5px; /* Rounded bottom right corner of last item*/\r\n}\r\n.custom_widget_MicrosoftFooter_bluesky_1w55e_473 {\r\n background-color: #f0f2f5;\r\n color: black;\r\n}\r\n.custom_widget_MicrosoftFooter_rss_1w55e_615 {\r\n background-color: #ec7b1c;\r\n}\r\n@media (max-width: 991px) {\r\n .custom_widget_MicrosoftFooter_social-share_1w55e_275 {\r\n display: none;\r\n }\r\n}\r\n","tokens":{"context-uhf":"custom_widget_MicrosoftFooter_context-uhf_1w55e_1","c-uhff-link":"custom_widget_MicrosoftFooter_c-uhff-link_1w55e_23","c-uhff":"custom_widget_MicrosoftFooter_c-uhff_1w55e_23","c-uhff-nav":"custom_widget_MicrosoftFooter_c-uhff-nav_1w55e_69","c-heading-4":"custom_widget_MicrosoftFooter_c-heading-4_1w55e_97","c-uhff-nav-row":"custom_widget_MicrosoftFooter_c-uhff-nav-row_1w55e_113","c-uhff-nav-group":"custom_widget_MicrosoftFooter_c-uhff-nav-group_1w55e_115","c-list":"custom_widget_MicrosoftFooter_c-list_1w55e_155","f-bare":"custom_widget_MicrosoftFooter_f-bare_1w55e_155","c-uhff-base":"custom_widget_MicrosoftFooter_c-uhff-base_1w55e_187","c-uhff-ccpa":"custom_widget_MicrosoftFooter_c-uhff-ccpa_1w55e_213","social-share":"custom_widget_MicrosoftFooter_social-share_1w55e_275","sharing-options":"custom_widget_MicrosoftFooter_sharing-options_1w55e_291","linkedin-icon":"custom_widget_MicrosoftFooter_linkedin-icon_1w55e_311","social-share-email-image":"custom_widget_MicrosoftFooter_social-share-email-image_1w55e_325","social-link-footer":"custom_widget_MicrosoftFooter_social-link-footer_1w55e_333","social-share-list":"custom_widget_MicrosoftFooter_social-share-list_1w55e_359","social-share-rss-image":"custom_widget_MicrosoftFooter_social-share-rss-image_1w55e_365","social-share-list-linkedin":"custom_widget_MicrosoftFooter_social-share-list-linkedin_1w55e_405","social-share-list-facebook":"custom_widget_MicrosoftFooter_social-share-list-facebook_1w55e_413","social-share-list-xicon":"custom_widget_MicrosoftFooter_social-share-list-xicon_1w55e_419","social-share-list-reddit":"custom_widget_MicrosoftFooter_social-share-list-reddit_1w55e_425","social-share-list-bluesky":"custom_widget_MicrosoftFooter_social-share-list-bluesky_1w55e_431","social-share-list-rss":"custom_widget_MicrosoftFooter_social-share-list-rss_1w55e_437","social-share-list-mail":"custom_widget_MicrosoftFooter_social-share-list-mail_1w55e_443","x-icon":"custom_widget_MicrosoftFooter_x-icon_1w55e_459","bluesky-icon":"custom_widget_MicrosoftFooter_bluesky-icon_1w55e_473","share-icon":"custom_widget_MicrosoftFooter_share-icon_1w55e_487","label":"custom_widget_MicrosoftFooter_label_1w55e_519","linkedin":"custom_widget_MicrosoftFooter_linkedin_1w55e_311","facebook":"custom_widget_MicrosoftFooter_facebook_1w55e_579","twitter":"custom_widget_MicrosoftFooter_twitter_1w55e_585","reddit":"custom_widget_MicrosoftFooter_reddit_1w55e_593","mail":"custom_widget_MicrosoftFooter_mail_1w55e_599","bluesky":"custom_widget_MicrosoftFooter_bluesky_1w55e_473","rss":"custom_widget_MicrosoftFooter_rss_1w55e_615"}},"form":null},"localOverride":false},"CachedAsset:text:en_US-components/community/Breadcrumb-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/community/Breadcrumb-1750857401000","value":{"navLabel":"Breadcrumbs","dropdown":"Additional parent page navigation"},"localOverride":false},"CachedAsset:text:en_US-components/tags/TagsHeaderWidget-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/tags/TagsHeaderWidget-1750857401000","value":{"tag":"{tagName}","topicsCount":"{count} {count, plural, one {Topic} other {Topics}}"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageListForNodeByRecentActivityWidget-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageListForNodeByRecentActivityWidget-1750857401000","value":{"title@userScope:other":"Recent Content","title@userScope:self":"Contributions","title@board:FORUM@userScope:other":"Recent Discussions","title@board:BLOG@userScope:other":"Recent Blogs","emptyDescription":"No content to show","MessageListForNodeByRecentActivityWidgetEditor.nodeScope.label":"Scope","title@instance:1722894000155":"Recent Discussions","title@instance:1727367112619":"Recent Blog Articles","title@instance:1727367069748":"Recent Discussions","title@instance:1727366213114":"Latest Discussions","title@instance:1727899609720":"","title@instance:1727363308925":"Latest Discussions","title@instance:1737115580352":"Latest Articles","title@instance:1720453418992":"Recent Discssions","title@instance:1727365950181":"Latest Blog Articles","title@instance:bmDPnI":"Latest Blog Articles","title@instance:IiDDJZ":"Latest Blog Articles","title@instance:1721244347979":"Latest blog posts","title@instance:1728383752171":"Related Content","title@instance:1722893956545":"Latest Skilling Resources","title@instance:dhcgCU":"Latest Discussions"},"localOverride":false},"Category:category:Exchange":{"__typename":"Category","id":"category:Exchange","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:Outlook":{"__typename":"Category","id":"category:Outlook","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:Community-Info-Center":{"__typename":"Category","id":"category:Community-Info-Center","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:EducationSector":{"__typename":"Category","id":"category:EducationSector","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:DrivingAdoption":{"__typename":"Category","id":"category:DrivingAdoption","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:Azure":{"__typename":"Category","id":"category:Azure","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:Windows-Server":{"__typename":"Category","id":"category:Windows-Server","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:MicrosoftTeams":{"__typename":"Category","id":"category:MicrosoftTeams","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:PublicSector":{"__typename":"Category","id":"category:PublicSector","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:microsoft365":{"__typename":"Category","id":"category:microsoft365","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:IoT":{"__typename":"Category","id":"category:IoT","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:HealthcareAndLifeSciences":{"__typename":"Category","id":"category:HealthcareAndLifeSciences","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:ITOpsTalk":{"__typename":"Category","id":"category:ITOpsTalk","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:MicrosoftLearn":{"__typename":"Category","id":"category:MicrosoftLearn","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Blog:board:MicrosoftLearnBlog":{"__typename":"Blog","id":"board:MicrosoftLearnBlog","blogPolicies":{"__typename":"BlogPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}},"boardPolicies":{"__typename":"BoardPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:AI":{"__typename":"Category","id":"category:AI","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:MicrosoftMechanics":{"__typename":"Category","id":"category:MicrosoftMechanics","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:MicrosoftforNonprofits":{"__typename":"Category","id":"category:MicrosoftforNonprofits","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:StartupsatMicrosoft":{"__typename":"Category","id":"category:StartupsatMicrosoft","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:PartnerCommunity":{"__typename":"Category","id":"category:PartnerCommunity","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:Microsoft365Copilot":{"__typename":"Category","id":"category:Microsoft365Copilot","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:Windows":{"__typename":"Category","id":"category:Windows","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:Content_Management":{"__typename":"Category","id":"category:Content_Management","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Category:category:microsoftintune":{"__typename":"Category","id":"category:microsoftintune","categoryPolicies":{"__typename":"CategoryPolicies","canReadNode":{"__typename":"PolicyResult","failureReason":null}}},"Conversation:conversation:2865990":{"__typename":"Conversation","id":"conversation:2865990","topic":{"__typename":"BlogTopicMessage","uid":2865990},"lastPostingActivityTime":"2025-07-08T17:09:57.159-07:00","solved":false},"User:user:293935":{"__typename":"User","uid":293935,"login":"Valon_Kolica","registrationData":{"__typename":"RegistrationData","status":null},"deleted":false,"avatar":{"__typename":"UserAvatar","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/dS0yOTM5MzUtODUxNDJpQkJBMUQ3QkZGMkQ1RjRBOQ"},"id":"user:293935"},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0yODY1OTkwLTMyOTAzNWlDRDlGRjE3QzMzMzY5QUI4?revision=369\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0yODY1OTkwLTMyOTAzNWlDRDlGRjE3QzMzMzY5QUI4?revision=369","title":"Trevor_Rusher_0-1637701732133.png","associationType":"TEASER","width":579,"height":268,"altText":"Trevor_Rusher_0-1637701732133.png"},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0yODY1OTkwLTMyODA3OGlGQ0Q4NTQ1NjAxN0MwNTk5?revision=369\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0yODY1OTkwLTMyODA3OGlGQ0Q4NTQ1NjAxN0MwNTk5?revision=369","title":"WebinarRecordings_TeaserHeader_2.0.png","associationType":"BODY","width":2489,"height":506,"altText":"WebinarRecordings_TeaserHeader_2.0.png"},"BlogTopicMessage:message:2865990":{"__typename":"BlogTopicMessage","subject":"Recordings | Security Community Webinars","conversation":{"__ref":"Conversation:conversation:2865990"},"id":"message:2865990","revisionNum":369,"uid":2865990,"depth":0,"board":{"__ref":"Blog:board:microsoft-security-blog"},"author":{"__ref":"User:user:293935"},"teaser@stripHtml({\"removeProcessingText\":true,\"truncateLength\":-1})":" https://youtu.be/PkdFIBvMVlw https://youtu.be/TmoS0tVwpAM See all of our recordings of past webinars here. To register for upcoming webinars visit aka.ms/SecurityCommunity. \n \n \n ","introduction":"","metrics":{"__typename":"MessageMetrics","views":99155},"postTime":"2021-11-17T15:35:16.890-08:00","lastPublishTime":"2025-07-08T17:09:57.159-07:00","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})":" \n \n \n \n Recordings of past webinars are below. To register for upcoming webinars visit aka.ms/SecurityCommunity. \n Also, explore the Microsoft Security Technical Content Library relevant to your needs. \n \n \n \n Asterisk (*) indicates updates to the file. \n \n \n AZURE COMPUTE \n \n 2024 \n \n Jan 30 \n \n Protect Data Source Integrity with Azure Confidential Ledger! \n \n YouTube \n \n Deck \n \n 2022 \n \n Apr 12 \n \n Azure Confidential VMs - When the Power of the Public Cloud Meets the Confidentiality of Your Private Datacenter \n \n YouTube \n \n Deck \n \n 2021 \n \n Feb 3 \n \n Confidential computing nodes on Azure Kubernetes Service \n \n YouTube \n \n Deck \n \n AZURE NETWORK SECURITY \n \n 2025 \n \n June 26 \n \n Mastering Azure WAF Rulesets: Best Practices and Strategies \n \n YouTube \n \n Deck \n \n June 5 \n \n Boosting Azure DDoS Protection with First-Party Integrations \n \n YouTube \n \n Deck \n \n Mar 20 \n \n What's New in Azure Firewall \n \n YouTube \n \n Deck \n \n Mar 6 \n \n Implementing Multi-Layered Security with Azure DDoS Protection and Azure WAF \n \n YouTube \n \n Deck \n \n Feb 26 \n \n Updating Your Azure Web Application Firewall Ruleset: Common Pitfalls and How to Avoid Them \n \n YouTube \n \n Deck \n \n Jan 28 \n \n Azure WAF Bot Protection: Features, Benefits, and Best Practices \n \n YouTube \n \n Deck \n \n Jan 15 \n \n Azure Firewall Private IP DNAT and Use Cases \n \n YouTube \n \n Deck \n \n 2024 \n \n Sep 17 \n \n Introducing DDoS Vulnerability Management for Azure DDoS Protection with MazeBolt \n \n YouTube \n \n Deck \n \n Jul 23 \n \n Unlock the Power of Azure Firewall Governance with Azure Policies \n \n YouTube \n \n Deck \n \n Jun 12 \n \n Azure Firewall Integration in Microsoft Copilot for Security \n \n YouTube \n \n Deck \n \n May 16 \n \n Azure Web Application Firewall (WAF) Integration in Microsoft Copilot for Security \n \n YouTube \n \n Deck \n \n Apr 23 \n \n Building a DDoS Response Plan \n \n YouTube \n \n Deck \n \n Mar 26 \n \n Essential Updates and Enhancements in the New WAF Ruleset \n \n YouTube \n \n Deck \n \n Feb 14 \n \n What's New in Azure Firewall \n \n YouTube \n \n Deck \n \n Jan 17 \n \n Azure DDoS Protection SecOps Deep-Dive \n \n YouTube \n \n Deck \n \n 2023 \n \n Dec 7 \n \n Azure Firewall Monitoring, Management and Troubleshooting \n \n YouTube \n \n Deck \n \n Nov 2 \n \n What's New in Azure WAF: Rate Limiting and Log Scrubbing \n \n YouTube \n \n Deck \n \n Oct 24 \n \n Azure DDoS Sentinel Solution Integration with WAF Playbook \n \n YouTube \n \n Deck \n \n Sep 26 \n \n Ask Me Anything (AMA) - Azure Firewall, Azure WAF and Azure DDoS \n \n YouTube \n \n Q&A \n \n Sep 12 \n \n Azure Firewall - IDPS Deep Dive \n \n YouTube \n \n Deck \n \n Aug 29 \n Jun 27 \n \n Azure DDoS Protection - Deep Dive \n Azure WAF Protection with Bot Manager Scenarios \n \n YouTube \n YouTube \n \n Deck \n Deck \n \n Jun 6 \n What's New in Azure Firewall \n YouTube \n \n Deck \n \n May 16 \n Automated Detection and Response for SQLi and XSS Attacks for Azure WAF using Microsoft Sentinel \n YouTube \n \n Deck \n \n May 4 \n Azure DDoS IP Protection \n YouTube \n \n Deck \n \n Mar 30 \n Azure DDoS Protection Integration with Microsoft Sentinel \n YouTube \n \n Deck \n \n Mar 23 \n How to Tune Your Azure WAF \n YouTube \n \n Deck \n \n Mar 16 \n Multi-Cloud: Protecting GCP and AWS Applications with Azure WAF \n YouTube \n \n Deck \n \n Feb 16 \n Azure Firewall SKUs - Basic vs Standard vs Premium \n YouTube \n \n Deck \n \n Jan 24 \n Private Link Integration with Azure Firewall \n YouTube \n \n Deck \n \n 2022 \n \n Nov 15 \n Azure DDoS IP Protection \n YouTube \n \n Deck \n \n Sep 29 \n Enhance your Azure Firewall Deployments \n YouTube \n \n Deck \n \n Sep 27 \n Azure Firewall Manager Integration with Azure WAF and DDoS \n YouTube \n \n Deck \n \n Sep 22 \n Single Click Migration for Azure Firewall \n YouTube \n \n Deck \n \n Sep 20 \n DDoS Attack Simulations \n YouTube \n \n Deck \n \n Sep 15 \n Azure Firewall Policy Analytics \n YouTube \n \n Deck \n \n Sep 6 \n Zero Trust Web Application Security with Azure WAF and Azure Firewall \n YouTube \n \n Deck \n 2021 \n Dec 15 \n Azure Virtual Network Manager: Simplify and Centrally Manage Azure Networks at Scale \n YouTube \n \n Deck \n \n May 20 \n \n Using Attack Simulation to Assess Protection and Detection Capabilities of Azure WAF \n \n YouTube \n \n Deck \n \n May 11 \n \n Central DNS Management and Logging with Azure Firewall \n \n YouTube \n \n Deck \n \n May 6 \n \n Exploring IDPS Capability in Azure Firewall Premium \n \n YouTube \n \n Deck \n \n May 4 \n \n Using Azure WAF Policies to Protect Your Web Application at Different Association Levels \n \n YouTube \n \n Deck \n \n Apr 27 \n \n Safeguards for a Successful Azure DDoS Protection Standard Deployment \n \n YouTube \n \n Deck \n \n Apr 6 \n \n Content Inspection Using TLS Termination with Azure Firewall Premium \n \n YouTube \n \n Deck \n \n 2020 \n \n Dec 10 \n \n Azure Network Security Advanced Architecture \n \n YouTube \n \n Deck \n \n Dec 8 \n \n Azure Network Security for SOCs \n \n YouTube \n \n Deck \n Dec 3 \n Getting started with Azure Firewall Manager \n \n YouTube \n \n Deck \n \n Dec 1 \n \n Manage application and network connectivity with Azure Firewall \n \n YouTube \n \n Deck \n \n Nov 12 \n \n Boosting your Azure Web Application (WAF) deployment \n \n YouTube \n \n Deck \n \n Nov 10 \n \n Getting started with Azure Distributed Denial of Service (DDoS) Protection \n \n YouTube \n \n Deck \n \n Oct 27 \n \n Protecting your web apps with Azure Web Application Firewall (WAF) \n \n YouTube \n \n Deck \n \n Oct 15 \n \n Introduction to Azure Network Security \n \n YouTube \n \n Deck \n \n MICROSOFT COPILOT FOR SECURITY \n 2025 Apr 9 \n \n \n Security Copilot AMA \n \n \n YouTube \n Deck \n 2024 Sep 4 \n \n \n How you can use Copilot for Security in Purview to support your Data Security investigations \n \n \n YouTube \n Deck \n Jul 11 \n \n \n Microsoft Copilot in Microsoft Defender for Cloud \n \n \n YouTube \n Deck \n \n Jun 12 \n \n Azure Firewall Integration in Microsoft Copilot for Security \n \n YouTube \n \n Deck \n \n Jun 5 \n \n Collecting Copilot Interactions using Purview eDiscovery \n \n YouTube \n \n Deck \n \n May 16 \n \n Azure Web Application Firewall (WAF) Integration in Microsoft Copilot for Security \n \n YouTube \n \n Deck \n \n Apr 11 \n \n TI at Machine Speed: Using MDTI in Copilot for Security \n \n YouTube \n \n Deck \n \n MICROSOFT DEFENDER XDR \n \n (Formerly Microsoft 365 Defender) \n \n 2025 \n June 25 \n Accelerating Threat Response with Microsoft Defender for Office 365 Automated Investigation and Response (AIR) \n \n YouTube \n \n Deck \n May 21 \n Mastering Microsoft Defender for Office 365: Configuration Best Practices \n \n YouTube \n \n Deck \n Apr 24 \n Secure Your Servers with Microsoft's Server Protection Solution \n \n YouTube \n \n Deck \n Apr 23 \n SaaS Security Exposure Reduction via the Exposure Management Platform \n \n YouTube \n \n Deck \n Apr 2 \n Securing AI Applications: Real-World Threats, Protection with Microsoft Defender for Cloud Apps, and Open Q&A \n \n YouTube \n \n Deck \n Feb 27 \n Licensing and Site Security in XDR \n \n YouTube \n \n Deck \n Feb 25 \n Learn About Insider Risk Management Data in Microsoft Defender XDR \n \n YouTube \n \n Deck \n Feb 18 \n AMA - Automatic Attack Disruption \n \n YouTube \n \n Deck \n Feb 12 \n How to Get the Most Out of Microsoft Defender for Vulnerability Management (MDVM) \n \n YouTube \n \n Deck \n Jan 23 \n Improved SecOps Efficiency with New Detections, Advanced Hunting, and Response Flows \n \n YouTube \n \n Deck \n \n 2024 \n Sep 11 \n New ways for security teams to protect OT environments with Defender XDR \n \n YouTube \n \n Deck \n May 1 \n POCaaS Session 4: Response \n \n YouTube \n \n Deck \n Apr 30 \n POCaas Session 3: Investigation and Hunting \n \n YouTube \n \n Deck \n \n Apr 24 \n \n POCaaS Session 2: Detection \n \n YouTube \n \n Deck \n \n Apr 23 \n \n POCaaS Session 1: ITDR Introduction and Prevention Capabilities \n \n YouTube \n \n Deck \n \n Feb 8 \n \n Descobrindo verdadeiras jóias em nossas soluções de segurança (Portuguese) \n \n YouTube \n \n Deck \n \n Feb 6 \n \n Descubriendo gemas ocultas en nuestras soluciones de seguridad (Spanish) \n \n YouTube \n \n Deck \n \n 2022 \n \n Nov 30 \n \n Software Usage Insights and Application Blocking with MDVM \n \n YouTube \n \n Deck \n \n Oct 27 \n \n Native Integration of Microsoft Defender for Cloud Apps in M365 Defender \n \n YouTube \n \n Deck \n \n Sep 27 \n \n Get a Grip on Critical Threats with Microsoft Defender Experts for Hunting \n \n YouTube \n \n Deck \n \n 2021 \n \n Oct 11 \n \n l33tSpeak: Advanced Hunting in Microsoft 365 Defender \n \n YouTube \n \n Demo \n \n Sep 15 \n \n Webinar Series: Monthly Threat Insights \n \n YouTube \n \n Deck \n \n Aug 18 \n \n Webinar Series: Monthly Threat Insights \n \n YouTube \n \n Deck \n \n Jul 29 \n \n Introduction to Microsoft Defender Application Guard for Office \n \n YouTube \n Deck \n Jul 21 \n \n Webinar series: Monthly Threat Insights \n \n YouTube \n \n Deck \n \n Jul 12 \n \n The story behind eSentire MDR with Microsoft 365 Defender: How eSentire streamlined security for itself and its customers \n \n YouTube \n \n Deck \n \n Jun 16 \n \n Webinar series: Monthly Threat Insights \n \n YouTube \n \n Deck \n \n May 10 \n \n l33tSpeak: Advanced Hunting in Microsoft 365 Defender \n \n YouTube \n \n GitHub \n \n May 3 \n \n Microsoft 365 Defender’s Unified Experience for XDR \n \n YouTube \n \n Deck \n \n Feb 22 \n \n What Tracking an Attacker Email Infrastructure Tells Us About Persistent Cybercriminal Operations \n \n YouTube \n \n Deck \n \n Jan 28 \n \n Protect, Detect, and Respond to Solorigate using Microsoft 365 Defender \n \n YouTube \n \n Deck \n \n 2020 \n \n Nov 17 \n \n l33tSpeak | Advanced hunting in Microsoft 365 Defender \n \n YouTube \n \n Demo \n \n Aug 5 \n \n Advanced Hunting series - Episode 4: Let’s hunt! Applying KQL to incident tracking \n \n YouTube \n \n Demo \n \n Jul 29 \n \n Advanced Hunting series - Episode 3: Summarizing, Pivoting, and Visualizing Data \n \n YouTube \n \n Demo \n \n Jul 22 \n \n Advanced Hunting series - Tracking the Adversary Episode 2: Joins \n \n YouTube \n \n Demo \n \n Jul 15 \n \n Advanced Hunting series - Tracking the Adversary Episode 1: KQL Fundamentals \n \n YouTube \n \n Demo \n \n MICROSOFT DEFENDER EXTERNAL ATTACK SURFACE MANAGEMENT (EASM) \n 2023 \n Jul 20 \n What's New in Microsoft Defender External Attack Surface Management \n YouTube \n \n Deck \n \n Mar 15 \n \n Introduction to Microsoft Defender External Attack Surface Management \n \n YouTube \n \n Deck \n \n MICROSOFT DEFENDER FOR CLOUD \n (Formerly Azure Security Center) \n 2025 May 27 Defender for SQL on Machines Enhanced Agent Update YouTube Deck May 22 What's New in Defender for Storage YouTube Deck May 15 Unlock Cloud Security Insights: Consuming Defender for Cloud Data with XDR Advanced Hunting YouTube Deck May 13 Safeguard Your Container Supply Chain with Microsoft Defender for Cloud YouTube Deck Apr 30 Go Beyond Checkboxes: Proactive Cloud Security with Microsoft Defender CSPM YouTube Deck Apr 15 Securing Custom Built AI Applications with Microsoft Defender for Cloud YouTube Deck Mar 5 API Security Posture with Defender for Cloud YouTube Deck 2024 Dec 12 \n \n \n Future-Proofing Cloud Security with Defender CSPM \n \n \n YouTube \n Deck \n Dec 11 \n \n \n Exploring the Latest Container Security Updates from Microsoft Ignite \n \n \n YouTube \n Deck \n Nov 14 \n \n \n Operationalizing Defender CSPM for Strategic Security Management \n \n \n YouTube \n Deck \n Oct 30 \n \n \n New Capabilities for Securing Containers in the Cloud \n \n \n YouTube \n Deck \n Oct 24 \n \n \n Enhancing Cloud Security Posture with Defender CSPM \n \n \n YouTube \n Deck \n Sep 25 \n \n \n Defender for Servers - New FIM Version \n \n \n YouTube \n Deck \n Sep 10 \n \n \n \n Prepare for Upcoming Transitions in Defender for Servers \n \n \n YouTube \n Deck \n Jul 11 \n \n \n Microsoft Copilot in Microsoft Defender for Cloud \n \n \n YouTube \n Deck \n Jun 20 \n \n \n Elevate Cloud Security Using Permissions Management in Microsoft Defender for Cloud \n \n \n YouTube \n Deck \n Jun 13 \n \n \n Shift Left with Microsoft Defender for Cloud \n \n \n YouTube \n Deck \n Jun 6 \n \n \n What's New in Microsoft Defender for Cloud Container Security \n \n \n YouTube \n Deck \n May 22 \n \n \n Simplifying Servers Security in Microsoft Defender for Cloud \n \n \n YouTube \n Deck \n Apr 25 \n \n \n Defender CSPM Internet Exposure Analysis \n \n \n YouTube \n Deck \n Apr 16 \n \n \n Defender CSPM Planning, Operationalization and Best Practices \n \n \n YouTube \n Deck \n Mar 19 \n \n \n Defender CSPM Risk Level Prioritization Analysis \n \n \n YouTube \n Deck \n Mar 13 \n \n \n What's New in the Last Three Months \n \n \n YouTube \n Deck \n Jan 24 \n \n \n Upgrade to Microsoft Defender Vulnerability Management \n \n \n YouTube \n Deck \n 2023 Dec 12 \n \n \n What's New in Microsoft Defender for Cloud \n \n \n YouTube \n Deck \n Nov 29 \n \n \n What's New in Microsoft Defender for Cloud Container Security \n \n \n YouTube \n Deck \n Oct 4 \n \n \n Discover and Protect Sensitive Data with Defender for Cloud \n \n \n YouTube \n Deck \n Sep 28 \n \n \n What’s New and What’s Next in Defender for Servers? \n \n \n YouTube \n Deck \n Sep 21 \n \n \n Demystifying Defender CSPM \n \n \n YouTube \n Deck \n Sep 19 \n \n \n Defender for Storage - What's New? \n \n \n YouTube \n Deck \n Aug 31 \n \n \n What’s New in the Last Three Months \n \n \n YouTube \n Deck \n Aug 8 \n \n \n All You Need to Know About Microsoft Defender for Cloud Multicloud Protection \n \n \n YouTube \n Deck \n Jul 12 \n \n \n Strengthening Your Cloud Security Posture with Microsoft Defender for Cloud \n \n \n YouTube \n Deck \n Jun 14 \n \n \n Securing APIs with Defender for APIs \n \n \n YouTube \n Deck \n May 10 \n \n \n Shift-Left and Secure Your Code Using Microsoft Defender for DevOps \n \n \n YouTube \n Deck \n May 2 \n \n \n What’s New in Cloud Data Security? \n \n \n YouTube \n Deck \n Jan 31 \n \n \n What's New in the Last 3 Months \n \n \n YouTube \n Deck \n Jan 25 \n \n \n Code to Cloud Security using Microsoft Defender for DevOps \n \n \n YouTube \n Deck \n Jan 18 \n \n \n A Day In the Life Series with Microsoft Defender for Cloud \n \n \n YouTube \n Deck \n \n 2022 \n Dec 15 \n \n \n Prevent Permissions Sprawl in Multicloud with Microsoft Defender for Cloud and Permissions Management \n \n \n YouTube \n Deck \n Dec 13 \n \n \n Protect your Cloud Workloads with Microsoft Defender for Cloud: A Cloud Native Application Protection Platform (CNAPP) \n \n \n YouTube \n Deck \n Dec 8 \n \n \n Secure your Containers from Build to Runtime \n \n \n YouTube \n Deck \n Dec 6 \n \n \n Keep Calm and Deploy Defender for Servers \n \n \n YouTube \n Deck \n Nov 23 \n \n \n Pregled Microsoft Defender for Cloud-a kao Modernog CSPM/CWP Rješenja (Croatian) \n \n \n YouTube \n Deck \n Nov 22 \n \n \n Multicloud Capabilities in Microsoft Defender for Cloud \n \n \n YouTube \n Deck \n Nov 17 \n \n \n Automating Cloud Security Posture and Cloud Workload Protection Responses \n \n \n YouTube \n Deck \n Nov 10 \n \n \n New Contextual CSPM a Context-Aware Security Intelligence \n \n \n YouTube \n Deck \n Nov 8 \n \n \n Demystifying Microsoft Defender for Servers \n \n \n YouTube \n Deck \n Nov 3 Deep Dive into Security Orchestration, Automation and Response (SOAR) using Microsoft Azure Security YouTube \n Deck \n Oct 25 What’s New in the Last 3 Months YouTube \n Deck \n Oct 20 Start Secure and Stay Secure Across Your Multicloud Environments with Microsoft Defender for Cloud YouTube \n Deck \n Aug 4 How to Ensure Maximum Security Posture for Your Government Cloud Environment and How to Protect It Using Microsoft Defender for Cloud YouTube \n Deck \n Jul 26 Improving Your Security Posture with Policy Enforcement and Governance YouTube \n Deck \n Jul 19 What's New in the Last 3 Months YouTube \n Deck \n Jun 30 Protect Your Databases Anywhere with Microsoft Defender for Cloud YouTube \n Deck \n Jun 21 Protect Your Azure Service Layer with Microsoft Defender for ARM & Defender for DNS YouTube \n Deck \n Jun 16 The Latest Microsoft Defender for Cloud News from RSA YouTube \n Deck \n May 26 Azure Security Benchmark V3 Workbook YouTube \n Deck \n May 17 \n How to Deploy Microsoft Defender for Cloud at Scale \n YouTube \n Deck \n Apr 26 \n What's New in 3 Months \n YouTube \n Deck \n Apr 14 Protecting Multi-Cloud Environments (AWS & GCP) with Microsoft Defender for Cloud YouTube \n Deck \n Mar 15 \n Demystifying Microsoft Defender for Containers \n YouTube \n Deck \n Jan 20 \n What's New in 3 Months \n YouTube \n Deck \n Jan 12 \n Introducing Microsoft Defender for Containers \n YouTube \n Deck \n \n 2021 \n \n Nov 17 \n \n NextGen Multi Cloud CSPM in Microsoft Defender for Cloud \n \n YouTube \n \n Deck \n \n Nov 16 \n Azure Security Ignite 2021 Updates \n YouTube \n \n Deck \n \n Oct 27 \n \n Azure Defender for SQL \n \n YouTube \n \n Deck \n \n Oct 26 \n \n Manage Your Security Risk and Compliance Requirements with Azure Security Center \n \n YouTube \n \n Deck \n \n Oct 20 \n \n What’s New in the Last 6 Months \n \n YouTube \n \n Deck \n \n Oct 5 \n \n Better Together: Azure Defender, Azure Sentinel, and M365 Defender \n \n YouTube \n \n Deck \n \n Aug 26 \n \n Better Together | Azure Security Center and Microsoft Defender for Endpoint \n \n YouTube \n \n Deck \n \n Jul 22 \n \n Manejo de Postura de Seguridad de la Nube y Protección de Cargas de Trabajo (Cloud Security Posture Management and Workload Protection) \n YouTube Deck \n May 13 \n \n Azure Workbooks in Security Center \n \n YouTube \n \n Deck \n \n Apr 29 \n \n Demystifying Azure Defender Once for All \n \n YouTube \n \n Deck \n \n Apr 28 \n \n \nAutomate(d) Security with Azure Security Center and Logic Apps \n YouTube \n \n Deck \n \n Mar 9 \n \n Azure Defender for Storage \n \n YouTube \n \n Deck \n \n Feb 23 \n \n Best Practices for Improving Your Secure Score \n \n YouTube \n \n Deck \n \n Jan 7 \n \n Azure service layers protection \n \n YouTube \n \n Deck \n \n 2020 \n \n Dec 7 \n \n Investigating Azure Security Center alerts using Azure Sentinel \n \n YouTube \n \n Deck \n \n Nov 30 \n \n Azure Defender for SQL Anywhere \n \n YouTube \n \n Deck \n \n Nov 9 \n \n Ignite 2020 Announcements \n \n YouTube \n \n Deck \n \n Nov 2 \n \n Enhance IoT Security & Visibility with Azure Defender and Azure Sentinel \n \n YouTube \n \n Deck \n \n Oct 28 \n \n Multi-Cloud support in Azure Security Center \n \n YouTube \n \n Deck \n Oct 26 \n VM Protection \n \n YouTube \n \n Deck \n Mar 11 \n Security Benchmark Policy \n \n YouTube \n \n Deck \n Feb 20 \n Secure Score enhanced model \n \n YouTube \n \n Deck \n MICROSOFT DEFENDER FOR CLOUD APPS\n (formerly Microsoft Cloud App Security) \n 2024 Sep 26 \n How to protect Oauth apps with app governance in Microsoft Defender for Cloud Apps \n \n YouTube \n \n Deck \n Jan 16 \n App Governance in MDA: What You Need to Know to Enhance Your Cloud Security Posture \n \n YouTube \n \n Deck \n 2023 May 31 \n App Governance Inclusion in Defender for Cloud Apps Overview \n \n YouTube \n \n Deck \n Feb 1 \n Protect, Detect, and Respond to Malicious OAuth Applications Abusing Cloud E-mail Services \n \n YouTube \n \n Deck \n 2022 Nov 16 \n App Governance is a Key Part of a Customers' Zero Trust Journey \n \n YouTube \n \n Deck \n Sep 14 \n Manage your SaaS Security Posture with Microsoft \n \n YouTube \n \n Deck \n 2021 Aug 17 \n Protect your Slack Deployment using Microsoft Cloud App Security \n \n YouTube \n \n Deck \n Jun 8 \n Protect Your Salesforce Environment Using MCAS \n \n YouTube \n \n Deck \n May 25 \n Improve Your AWS Security Posture Using MCAS \n \n YouTube \n \n Deck \n May 12 \n Protect Your Box Deployment Using MCAS \n \n YouTube \n \n Deck \n May 11 \n How to Protect Your GitHub Environment Using MCAS \n \n YouTube \n \n Deck \n 2020 Apr 15 \n Enabling Secure Remote Work \n \n YouTube \n \n Deck \n \n MICROSOFT DEFENDER FOR ENDPOINT \n 2021 Nov 29 Protect Your Mobile Devices with Microsoft Defender for Endpoint \n YouTube \n \n Deck \n May 18 \n Stopping Cabanak+FIN7: Understanding the MITRE Engenuity ATT&CK Results \n \n YouTube \n \n Deck \n \n 2020 \n Sep 16 \n Get started with Microsoft Defender ATP: from zero to hero \n \n YouTube \n \n Deck \n Jul 7 \n Deploy MDATP capabilities using a phased roadmap \n \n YouTube \n \n Deck \n Apr 2 \n End-to-end security for your endpoints \n \n YouTube \n \n Deck \n MICROSOFT DEFENDER FOR IDENTITY 2023 Sep 12 \n Defender for Identity in the Microsoft 365 Defender Portal: Tips and Tricks \n \n YouTube \n \n Deck \n Jun 14 \n Become an Advisor to Our Product Engineering Team \n \n YouTube \n \n Deck \n 2022 Sep 6 \n Identity Targeted Attacks - A Researcher's Point of View \n \n YouTube \n \n Deck \n Mar 2 \n New Remediation Actions in Microsoft Defender for Identity \n \n YouTube \n \n Deck \n 2021 Oct 6 \n Microsoft Defender for Identity’s Latest Detection Capabilities \n \n YouTube \n \n Deck \n Jun 22 \n MDI in the Microsoft 365 Security Center \n \n YouTube \n \n Deck \n Jun 1 \n Detection Deep Dive with Defender for Identity’s Engineering Experts \n \n YouTube \n \n Deck \n Mar 23 \n Proactive Identity Posture Management \n \n YouTube \n \n Deck \n \n MICROSOFT DEFENDER FOR IoT \n (formerly Azure Defender for IoT) \n 2023 Jun 21 Successful Deployment of Microsoft Defender for IoT \n YouTube \n \n Deck \n Mar 1 OT/IoT Enabled SOC with Microsoft Sentinel and Microsoft Defender for IoT \n YouTube \n \n Deck \n Jan 26 Azure Manager Secure Connectivity and Advantages \n YouTube \n \n Deck \n 2022 Oct 27 Best Practices for Facilitating OT/IoT Enablement in the Corporate SOC \n YouTube \n \n Deck \n Sep 14 The Last Piece of the XDR Puzzle - Augmenting IT SecOps with IoT Security \n YouTube \n \n Deck \n Jul 28 IT/OT Threat Monitoring Solution \n YouTube \n \n Deck \n Jul 20 Securing Critical Networks Through Defender for IoT and Horizon DPI \n YouTube \n \n Deck \n Jun 29 Better Together: Microsoft Defender for IoT and ServiceNow’s Operational Technology (OT) Management \n YouTube \n \n Deck \n May 24 Section 52 - Investigating Malicious Ladder Logic \n YouTube \n \n Deck \n Apr 6 How to Discover and Secure IoT Devices in the Enterprise Environment \n YouTube \n \n Deck \n Mar 24 \n Better Together: Microsoft Sentinel - IT/OT Threat Monitoring with Defender for IoT Solution \n \n YouTube \n \n Deck \n Feb 23 \n Cloud Capabilities and Security Advantages \n \n YouTube \n \n Deck \n 2021 Oct 19 \n Agent Based Solution for IoT Device \n \n YouTube \n \n Deck \n Jan 20 \n Leveraging OT Behavioral Analytics and Zero Trust for OT Cyber Resilience \n \n YouTube \n \n Deck \n 2020 Sep 17 \n MITRE ATT&CK for ICS: CyberX Demo and Azure IoT/OT Security Deep Dive \n \n YouTube \n \n Deck \n \n MICROSOFT DEFENDER THREAT INTELLIGENCE \n 2024 \n Apr 11 \n \n TI at Machine Speed: Using MDTI in Copilot for Security \n \n YouTube \n \n Deck \n 2023 \n Sep 20 \n \n Unleashing the Power of Threat Intelligence with the MDTI GitHub \n \n YouTube \n \n Deck \n \n Jul 26 \n \n Adopting Intel-led Threat Protection With MDTI \n \n YouTube \n \n Deck \n \n May 11 \n \n What's New in Microsoft Defender Threat Intelligence \n \n YouTube \n \n Deck \n \n Feb 15 \n \n Microsoft Defender Threat Intelligence Overview \n \n YouTube \n \n Deck \n \n MICROSOFT ENTRA (AZURE AD) \n 2024 \n Feb 8 \n \n Descobrindo verdadeiras jóias em nossas soluções de segurança (Portuguese) \n \n YouTube \n \n Deck \n \n Feb 6 \n \n Descubriendo gemas ocultas en nuestras soluciones de seguridad (Spanish) \n \n YouTube \n \n Deck \n 2023 \n Nov 7 \n \n Entra Identity Governance: Deep Dive - Part 2 of 2 \n \n YouTube \n \n Deck \n \n Oct 31 \n \n Entra Identity Governance: Deep Dive - Part 1 of 2 \n \n YouTube \n \n Deck \n \n MICROSOFT PURVIEW \n (Data Security & Privacy) \n 2025 July 8 Unlock the Power of Data Security Investigations with Microsoft Purview \n YouTube \n \n Deck \n June 10 Purview for AI Network Level Integration \n YouTube \n \n Deck \n June 4 Boosting Azure DDoS Protection with First-Party Integrations \n YouTube \n \n Deck \n May 8 Data Security: Insider Threats- Are They Real? \n YouTube \n \n Deck \n May 7 Data Security: What's New in DLP? \n YouTube \n \n Deck \n May 6 Data Security: What's New in MIP? \n YouTube \n \n Deck \n Apr 22 eDiscovery New User Experience and Retirement of Classic \n YouTube \n \n Deck \n Mar 19 Unlocking the Power of Microsoft Purview for ChatGPT Enterprise \n YouTube \n \n Deck \n Mar 18 Inheriting Sensitivity Labels from Shared Files to Teams Meetings \n YouTube \n \n Deck \n Mar 12 Microsoft Purview AMA - Data Security, Compliance, and Governance \n YouTube \n \n NA \n Jan 8 Microsoft Purview AMA \n YouTube \n \n NA \n 2024 Dec 10 IGNITE - Data Lifecycle Management (DLM) | Compliance Manager | \n NA \n \n NA \n \n Nov 13 \n \n Audit Services 2.0 \n \n YouTube \n \n Deck \n \n Oct 16 \n \n Introduction to Data Lifecycle Management (DLM) | Compliance Manager | Part 1 \n \n YouTube \n \n Deck \n \n Oct 15 \n \n Navigating the Future of AI: Understanding the EU AI Act and Its Implications \n \n YouTube \n \n Deck \n \n Sep 18 \n \n Microsoft Purview eDiscovery Modern UX \n \n YouTube \n \n Deck \n \n Sep 4 \n \n \n How can you use Copilot for Security in Purview to support your Data Security investigations \n \n YouTube \n \n Deck \n \n Jul 10 \n \n Audit Services \n \n YouTube \n \n Deck \n \n Jul 9 \n \n Data Lifecycle Management & Records Management (DLM & RM) Services \n \n YouTube \n \n Deck \n \n Jun 5 \n \n Collecting Copilot Interactions using Purview eDiscovery \n \n YouTube \n \n Deck \n \n May 30 \n \n Implementing the NIST AI RMF: A Roadmap to Responsible AI \n \n YouTube \n \n Deck \n \n May 29 \n \n Mastering CSRD Compliance: Essential Insights using Purview Compliance Manager \n \n YouTube \n \n Deck \n \n Jan 23 \n \n Getting started with deploying Microsoft Purview Data Lifecycle and Records Management \n \n YouTube \n \n Deck \n 2023 \n Oct 31 \n \n Microsoft Purview Data Loss Prevention - Maintain your Endpoint DLP Confidently \n \n YouTube \n \n Deck \n \n Jun 7 \n \n Microsoft Purview Advanced Classification Scanning and Protection for Endpoints Running on Mac OS \n \n YouTube \n \n Deck \n \n Apr 5 \n \n Endpoint DLP and DLP Incident Management \n \n YouTube \n \n Deck \n 2020 \n Jul 29 \n \n Discover Multi Cloud Data in Purview \n \n YouTube \n \n Deck \n \n Jun 17 \n \n Better Together: E2E Sensitivity Label Flow from M365 to Azure Purview to SQL to Power BI \n \n YouTube \n \n Deck \n \n Jan 27 \n \n Introduction to Azure Purview \n \n YouTube \n \n Deck \n \n MICROSOFT SENTINEL \n (formerly Azure Sentinel) \n 2025 May 29 \n Explore New Case Management Features \n YouTube \n Deck \n May 20 \n Unlocking the Power of the Unified SecOps: Mastering Multiple Workspaces and Tenants \n YouTube \n Deck \n Apr 10 \n What's New in Microsoft Sentinel and the Unified Security Operations Platform \n YouTube \n Deck \n Apr 1 \n Transition to the Unified SOC Platform: Deep Dive and Interactive Q&A for SOC Professionals \n YouTube \n Deck \n Feb 19 \n Microsoft Sentinel Repositories: Manage Your SIEM Content Like a Pro \n YouTube \n Deck \n 2024 \n Oct 29 \n \n \n \n Data Tiering Best Practices \n \n \n YouTube \n Deck \n \n Oct 9 \n \n \n \n Deep Dive: Moving from the Log Analytics Agent to the New Azure Monitor Agent \n \n \n YouTube \n Deck \n \n Oct 1 \n \n \n \n Building Microsoft Sentinel integrations - Part 2: Creating data connectors \n \n \n YouTube \n Deck \n \n Aug 29 \n \n \n \n What's New in Microsoft Sentinel \n \n \n YouTube \n Deck \n \n Jun 4 \n \n \n \n Building Microsoft Sentinel Integrations - Part 1: Onboarding \n \n \n YouTube \n Deck \n May 21 \n \n \n Optimizing Your Security Operations: Manage Your Data, Costs and Protections with SOC Optimizations in Microsoft Sentinel \n \n \n YouTube \n Deck \n May 2 \n \n \n Splunk to Microsoft Sentinel Migration Experience \n \n \n YouTube \n Deck \n Apr 18 \n \n \n What's New in Microsoft Sentinel & Unified Portal Enhancements \n \n \n YouTube \n Deck \n 2023 Nov 28 \n \n \n Secure Dynamics 365 and Power Platform with the Microsoft Sentinel Solutions for MS Business Applications \n \n \n YouTube \n Deck \n Oct 3 \n \n \n Expedite Alignment to the DoD Zero Trust Guidance with Microsoft Sentinel \n \n \n YouTube \n Demo \n Sep 20 \n \n \n Dive Into the New Microsoft Sentinel OOTB (out-of-the-box) Content Experiences \n \n \n YouTube \n Deck \n Sep 13 \n \n \n What's New in the Last 6 Months \n \n \n YouTube \n Deck \n Jun 8 \n \n \n Secure your SAP Environment with the Microsoft Sentinel Solution for SAP® Applications \n \n \n YouTube \n Deck \n Jan 25 \n \n \n What's New in the Last 6 Months \n \n \n YouTube \n Deck \n Jan 17 \n \n \n Announcing the New Microsoft Sentinel Incident Investigation Experience! \n \n \n YouTube \n Deck \n \n \n \n 2022 \n \n \n Oct 19 \n \n \n Pregled Microsoft Sentinel-a kao Modernog SIEM/SOAR Rješenja (Croatian) \n \n \n YouTube \n Demo \n Sep 21 \n \n \n Pregled Microsoft Sigurnosnih Rjesenja (Bosnian-Serbian-Croatian) \n \n \n YouTube \n Deck \n Sep 13 \n \n \n NIST SP 800-53 Solution \n \n \n YouTube \n Deck \n Sep 8 \n \n \n Microsoft Sentinel Threat Protection Solution for SAP \n \n \n YouTube \n Deck \n Aug 31 \n \n \n Utilizando Microsoft Sentinel de ponta a ponta em SOC (Portuguese) \n \n \n YouTube \n Deck \n Aug 29 \n \n \n Utilizando Microsoft Sentinel de punta a punta en su SOC (Spanish) \n \n \n YouTube \n Deck \n Aug 25 \n \n \n MSTICPy 2.0: What’s New in Microsoft’s Jupyter and Python Security Toolset \n \n \n YouTube \n Demo \n Aug 17 \n \n \n Gerenciando o ciclo de vida do seu log (Portuguese) \n \n \n YouTube \n Deck \n Aug 16 \n \n \n Cybersecurity Maturity Model Certification (CMMC) 2.0 Solution \n \n \n YouTube \n Deck \n Aug 15 \n \n \n Administracion del ciclo de vida de sus Registros (Spanish) \n \n \n YouTube \n Deck \n Aug 11 \n \n \n Building on Microsoft Sentinel Platform \n \n \n YouTube \n Deck \n Jul 28 \n \n \n IT/OT Threat Monitoring Solution \n \n \n YouTube \n Deck \n Jul 27 \n \n \n Novidades do Microsoft Sentinel (Portuguese) \n \n \n YouTube \n Deck \n Jul 21 Microsoft Sentinel Fusion: New Detection Capabilities & Features Explained YouTube \n Deck \n Jul 14 Cyber Threat Intelligence Demystified in Microsoft Sentinel YouTube \n Deck \n Jul 12 Zero Trust (TIC 3.0) Solution YouTube \n Deck \n Jun 28 Codeless Connector Platform: Create Your Data Connector in Microsoft Sentinel YouTube \n Deck \n Jun 23 Leverage new and existing features to optimize cost in Microsoft Sentinel YouTube \n Deck \n May 31 Transforming Data at Ingestion Time in Microsoft Sentinel YouTube \n Deck \n May 10 Microsoft Sentinel Automation: Tips & Tricks YouTube \n Deck \n Apr 28 Unleash the Power of Analytics to Strengthen Your SOC Against Threats YouTube \n Deck \n Apr 7 Manage Your Log Lifecycle with New Methods for Ingestion, Archival, Search, and Restoration YouTube \n Deck \n Mar 31 Modernize Log Management with the Maturity Model for Event Log Management (M-21-31) Solution YouTube \n Deck \n Mar 29 Use Watchlist to Manage Alerts, Reduce Alert Fatigue, and Improve SOC Efficiency YouTube \n Deck \n Mar 22 Extend and Manage ASIM: Developing, Testing and Deploying ASIM Parsers YouTube \n Deck \n Mar 9 The Advanced SIEM Information Model (ASIM): Now Built into Microsoft Sentinel YouTube \n Deck \n Mar 1 What's Next in Microsoft Sentinel YouTube \n Deck \n Feb 10 Automate Your Microsoft Sentinel Triage Efforts with RiskIQ Threat Intelligence YouTube \n Deck \n Feb 3 \n Become a Jupyter Notebooks Ninja – MSTICPy Intermediate to Build Your Own Notebooks \n YouTube \n Demo \n Jan 19 \n Present and Future of User Entity Behavioral Analytics in Microsoft Sentinel \n YouTube \n Deck \n 2021 Dec 16 \n Become a Jupyter Notebooks Ninja – MSTICPy Fundamentals to Build Your Own Notebooks \n YouTube \n Demo \n Dec 8 \n Overview of the SOC Process Framework \n YouTube \n Demo \n Dec 7 \n KQL Framework for Microsoft Sentinel -Empowering You to Become KQL-Savvy \n YouTube \n Deck \n Dec 2 Microsoft Sentinel Content Management YouTube \n Deck \n Dec 1 Fusion ML Detections for Emerging Threats & Configuration UI YouTube \n Deck \n Nov 22 Everything You Ever Wanted to Know About Using the New Azure Monitor Agent (AMA) with Microsoft Sentinel \n YouTube \n \n Deck \n Nov 16 Create Your Own Microsoft Sentinel Solutions \n YouTube \n \n Deck \n Nov 15 Improving the Breadth and Coverage of Threat Hunting with ADX Support, More Entity Types, and Updated MITRE Integration \n YouTube \n \n Deck \n Nov 10 \n Decrease Your SOC’s MTTR (Mean Time to Respond) by Integrating Microsoft Sentinel with Microsoft Teams \n \n YouTube \n \n Deck \n Nov 9 \n SAP Mini-Series Part 2: Deep Dive - End-to-End Installation of SAP for Microsoft Sentinel \n \n YouTube \n \n Deck \n Nov 8 \n Latest Innovations for Microsoft’s Cloud Native SIEM \n \n YouTube \n \n Deck \n Oct 28 \n What’s New in Azure Sentinel Automation \n \n YouTube \n \n Deck \n Oct 25 \n Explore the Power of Threat Intelligence in Azure Sentinel \n \n YouTube \n \n Deck \n Oct 18 \n SAP Mini-Series Part 1: Introduction to Monitoring SAP with Azure Sentinel for Security Professionals \n \n YouTube \n \n Deck \n Oct 11 \n Become a Notebooks Ninja – Getting Started with Jupyter Notebooks in Azure Sentinel \n \n YouTube \n \n Deck \n Oct 6 \n Turbocharging ASIM: Making Sure Normalization Helps Performance \n Rather Than Impacting It \n \n YouTube \n \n Deck* \n Sep 29 \n Better Together | OT and IoT Attack Detection, Investigation and Response \n \n YouTube \n \n Deck \n Sep 15 \n What's New in the Last 6 Months \n \n YouTube \n \n Deck \n Sep 14 \n Learn About Customizable Anomalies and How to Use Them \n \n YouTube \n \n Deck \n Aug 18 \n Fusion ML Detections with Scheduled Analytics Rules \n \n YouTube \n \n Deck \n Aug 11 \n Deep Dive into Azure Sentinel Normalizing Parsers and Normalized Content \n \n YouTube \n \n Deck \n Jul 28 \n The Information Model: Understanding Normalization in Azure Sentinel \n \n YouTube \n \n Deck \n Jul 20 \n Streamlining your SOC Workflow with Automated Notebooks \n \n YouTube \n \n Deck \n Jul 13 \n Customizing Azure Sentinel with Python - MSTICPy and Jupyter Notebooks \n \n YouTube \n \n Deck \n Jun 29 \n Threat Intelligence in Action with Anomali \n \n YouTube \n \n Deck \n Jun 24 \n Cost Management in Azure Sentinel - Getting the Most for Your Investment \n \n YouTube \n \n Deck \n May 26 \n Deep Dive into Azure Sentinel Innovations for RSA 2021 \n \n YouTube \n \n Deck \n Mar 31 \n Using Azure Data Explorer as Your Long Term Retention Platform of Azure Sentinel Logs \n \n YouTube \n \n Deck \n Mar 18 \n Data Collection Scenarios \n \n YouTube \n \n Deck \n Feb 18 \n Best Practices for Converting Detection Rules from Splunk, QRadar, and ArcSight to Azure Sentinel Rules \n \n YouTube \n \n Deck \n Feb 4 \n Accelerate Your Azure Sentinel Deployment with the All-in-One Accelerator \n \n YouTube \n \n Deck \n Jan 21 \n Auditing and monitoring your Azure Sentinel workspace \n \n YouTube \n \n Deck \n Jan 19 \n Azure Notebooks Fundamentals – How to get started \n \n YouTube \n \n Deck \n Jan 12 \n Machine Learning detections in the AI-infused Azure Sentinel SIEM \n \n YouTube \n \n Deck \n 2020 Sep 30 \n Unleash your Azure Sentinel automation Jedi tricks and build Logic Apps Playbooks like a Boss \n \n YouTube \n \n Deck \n Sep 29 \n Enabling User and Entity Behavior Analytics (UEBA) | Hunting for Insider Threats \n \n YouTube \n \n Deck \n Sep 14 \n Empowering the Azure Sentinel Community with Pre-Recorded Datasets for research and training purposes \n \n YouTube \n \n Deck \n Sep 9 \n KQL part 3 of 3 - Optimizing Azure Sentinel KQL queries performance \n \n YouTube \n \n Deck \n Sep 2 \n Log Forwarder deep dive | Filtering CEF and Syslog events \n \n YouTube \n \n Deck \n Aug 19 \n Threat intelligence automation with RiskIQ \n \n YouTube \n \n Deck \n Aug 12 \n Threat hunting and reduce dwell times with Azure Sentinel \n \n YouTube \n \n Deck \n Jul 28 \n KQL part 2 of 3: KQL hands-on lab exercises \n \n YouTube \n \n *Deck \n Jul 9 \n Workbooks deep dive - Visualize your security threats and hunts \n \n YouTube \n \n Deck \n Jun 23 \n Multi-tenant investigations \n \n YouTube \n \n Deck \n Jun 15 \n Deploying and Managing Azure Sentinel as Code \n \n YouTube \n \n Deck \n Jun 2 \n KQL part 1 of 3: Learn the KQL you need for Azure Sentinel \n \n YouTube \n \n *Deck \n May 13 \n Using Sigma to accelerate your SIEM transformation to Azure Sentinel \n \n YouTube \n \n Deck \n Apr 22 \n Threat Hunting on AWS using Sentinel \n \n YouTube \n \n Deck \n Apr 20 \n MSSP and Distributed Organization Support \n \n YouTube \n \n Deck \n Mar 31 \n Extending and Integrating Azure Sentinel (APIs) \n \n YouTube \n \n *Deck \n Mar 18 \n Deep Dive on Threat Intelligence \n \n YouTube \n \n Deck \n Mar 4 \n Recap of RSA 2020 \n \n YouTube \n \n Deck \n Feb 19 \n Tackling Identity \n \n YouTube \n \n *Deck \n Feb 12 \n Deep Dive on Correlation Rules \n \n YouTube \n \n *Deck \n Jan 29 \n Threat Hunting - revisited \n \n YouTube \n \n Deck \n Jan 22 \n End-to-End SOC scenario \n \n YouTube \n \n Deck \n MICROSOFT MISCELLANEOUS SECURITY WEBINARS CYBERSECURITY FUNDAMENTALS 2023 Oct 10 2023 Microsoft Digital Defense Report YouTube Deck 2022 Dec 7 Microsoft Digital Defense Report 2022 YouTube Deck Aug 23 A Microsoft Overview of Russia’s Cyberattack Activity in Ukraine YouTube Deck 2021 Dec 6 Cloud Katana YouTube Deck Oct 21 Hacking AI with Counterfit YouTube Deck Oct 14 Exploiting Vulnerabilities in Azure Stack Hub (Note: All exploits discussed during the webinar have been addressed.) YouTube Deck Oct 7 \n Combating Manipulated Media -Media Provenance \n YouTube Deck Jul 1 Spa Treatments: Web Security in Single Page Applications YouTube Deck Jun 15 Best Practices of Authentication & Authorization Methods YouTube Deck Mar 24 Who Wants a Thousand Free Puppies? Managing Open Source Software Security in The Enterprise YouTube Deck Feb 16 The Billion-Dollar Central Bank Heist YouTube Deck 2020 Dec 9 Microsoft Digital Defense Report YouTube Deck Oct 29 Cybersecurity Basics: Securing Yourself YouTube Deck DIVERSITY IN CYBERSECURITY 2022 June 14 Connecting Women in Technology \n YouTube \n \n n/a \n May 12 Speaking Up for Minorities in Tech \n YouTube \n \n n/a \n May 3 Navigating Mentorship of the Security and Veteran Communities \n YouTube \n \n n/a \n Apr 13 \n Achievement Unlocked: A Real Life-Size Statue of a Latina Woman in Tech \n 2021 \n \n YouTube \n \n n/a \n Nov 18 \n Cristhofer Muñoz: Encouraging Young Talent \n \n YouTube \n \n Deck \n Oct 4 \n Mekonnen Kassa: From a Refugee to Microsoft: Impact of Active Allyship \n \n YouTube \n \n Deck \n May 27 \n Sarah Young: How Unconventional Career Paths are Making a Difference in the Technology \n \n YouTube \n \n Deck \n Mar 16 \n Sue Loh, software engineer at Microsoft and author of the young adult hacker novel Raven, inspires girls and other under-represented groups to enter tech. \n \n YouTube \n \n Deck \n \n LATAM WEBINARS \n 2024 \n Feb 8 \n \n Descobrindo verdadeiras jóias em nossas soluções de segurança (Portuguese) \n \n YouTube \n \n Deck \n \n Feb 6 \n \n Descubriendo gemas ocultas en nuestras soluciones de seguridad (Spanish) \n \n YouTube \n \n Deck \n 2022 Aug 31 \n \n \n Utilizando Microsoft Sentinel de ponta a ponta em SOC (Portuguese) \n \n \n YouTube \n Deck \n Aug 29 \n \n \n Utilizando Microsoft Sentinel de punta a punta en su SOC (Spanish) \n \n \n YouTube \n Deck \n Aug 17 \n \n \n Gerenciando o ciclo de vida do seu log (Portuguese) \n \n \n YouTube \n Deck \n Aug 15 \n \n \n Administracion del ciclo de vida de sus Registros (Spanish) \n \n \n YouTube \n Deck \n Jul 27 \n \n \n Novidades do Microsoft Sentinel (Portuguese) \n \n \n YouTube \n Deck \n 2021 \n Jul 22 \n \n Manejo de Postura de Seguridad de la Nube y Protección de Cargas de Trabajo (Spanish) \n YouTube Deck \n \n \n ","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})@stringLength":"40938","kudosSumWeight":3,"repliesCount":11,"readOnly":false,"images":{"__typename":"AssociatedImageConnection","edges":[{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0yODY1OTkwLTMyOTAzNWlDRDlGRjE3QzMzMzY5QUI4?revision=369\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDI","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS0yODY1OTkwLTMyODA3OGlGQ0Q4NTQ1NjAxN0MwNTk5?revision=369\"}"}}],"totalCount":2,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"videos":{"__typename":"VideoConnection","edges":[],"totalCount":0,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"coverImage":null,"coverImageProperties":{"__typename":"CoverImageProperties","style":"STANDARD","titlePosition":"BOTTOM","altText":""}},"Conversation:conversation:4427195":{"__typename":"Conversation","id":"conversation:4427195","topic":{"__typename":"BlogTopicMessage","uid":4427195},"lastPostingActivityTime":"2025-06-26T08:00:00.035-07:00","solved":false},"User:user:2929579":{"__typename":"User","uid":2929579,"login":"chmcconnell","registrationData":{"__typename":"RegistrationData","status":null},"deleted":false,"avatar":{"__typename":"UserAvatar","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/dS0yOTI5NTc5LVc1TEc2YQ?image-coordinates=0%2C263%2C866%2C1130"},"id":"user:2929579"},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LVhnOUxLcQ?revision=3\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LVhnOUxLcQ?revision=3","title":"img.png","associationType":"COVER","width":1280,"height":854,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LUJSUUFIWA?revision=3\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LUJSUUFIWA?revision=3","title":"image.png","associationType":"BODY","width":966,"height":547,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LU5NMUJKTg?revision=3\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LU5NMUJKTg?revision=3","title":"image.png","associationType":"BODY","width":1097,"height":400,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LWp3NzNVOA?revision=3\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LWp3NzNVOA?revision=3","title":"image.png","associationType":"BODY","width":1110,"height":377,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LUpPWUdYTQ?revision=3\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LUpPWUdYTQ?revision=3","title":"image.png","associationType":"BODY","width":975,"height":443,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LW5DcVhtTg?revision=3\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LW5DcVhtTg?revision=3","title":"image.png","associationType":"BODY","width":975,"height":487,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LU13cUdkag?revision=3\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LU13cUdkag?revision=3","title":"image.png","associationType":"BODY","width":975,"height":485,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LWd2cXlURA?revision=3\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LWd2cXlURA?revision=3","title":"image.png","associationType":"BODY","width":949,"height":534,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LVJFYlZtag?revision=3\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LVJFYlZtag?revision=3","title":"clipboard_image-1-1750879229294.png","associationType":"BODY","width":1600,"height":900,"altText":""},"BlogTopicMessage:message:4427195":{"__typename":"BlogTopicMessage","subject":"Modern, unified data security in the AI era: New capabilities in Microsoft Purview","conversation":{"__ref":"Conversation:conversation:4427195"},"id":"message:4427195","revisionNum":3,"uid":4427195,"depth":0,"board":{"__ref":"Blog:board:microsoft-security-blog"},"author":{"__ref":"User:user:2929579"},"teaser@stripHtml({\"removeProcessingText\":true,\"truncateLength\":-1})":"","introduction":"","metrics":{"__typename":"MessageMetrics","views":617},"postTime":"2025-06-26T08:00:00.035-07:00","lastPublishTime":"2025-06-26T08:00:00.035-07:00","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})":" AI is transforming how organizations work—but it’s also changing how data moves, who can access it, and how easily it can be exposed. Sensitive data now appears in AI prompts, Copilot responses, and across a growing ecosystem of SaaS and GenAI tools. To keep up, organizations need data security that’s built for how people work with AI today. \n Microsoft Purview brings together native classification, visibility, protection and automated workflows across your data estate—all in one integrated platform. \n Today, we’re highlighting some of our new capabilities that help you: \n \n Uncover data blind spots: Discover hidden risks and improve data security posture and find sensitive data on endpoints with on-demand classification \n Strengthen protection across data flows: Enhance oversharing controls for Microsoft 365 Copilot, expand protection to more Azure data sources, and extend data security to the network layer \n Respond faster with automation: Automate investigation workflows with Alert agents in Data Loss Prevention (DLP) and Insider Risk Management (IRM) \n \n Discover hidden risks and improve data security posture \n Many security teams struggle with fragmented tools that siloes sensitive data visibility across apps and clouds. According to recent studies, 21% of decision-makers cite the lack of unified visibility as a top barrier to effective data security. This leads to gaps in protection and inefficient incident response—ultimately weakening the organization’s overall data security posture. \n To help organizations address these challenges, last November at Ignite we launched Microsoft Purview Data Security Posture Management (DSPM), and we’re excited to share that this capability is now available. DSPM continuously assesses your data estate, surfaces contextual insights into sensitive data and its usage, and recommends targeted controls to reduce risk and strengthen your data security program. \n We’re also bringing in new signals from email exfiltration and from user activity in the browser and network into DSPM’s insights and policy recommendations, making sure organizations can improve their protections and address potential data security gaps. \n You can now also experience deeper investigations into DSPM with 3x more suggested prompts, outcome-based promptbooks and new guidance experience that helps interpret unsupported user queries and offers helpful alternatives, increasing usability without hard stops. \n \n New Security Copilot task-based promptbooks in Purview DSPM \n Learn more about how DSPM can help your organization strengthen your data security posture. \n Find sensitive data on endpoints with on-demand classification \n Security teams often struggle to uncover sensitive data sitting for a long time on endpoints, one of the most overlooked and unmanaged surfaces in the data estate. Typically, data gets classified when a file is created, modified, or accessed. As a result, older data at rest that hasn’t been touched in a while can remain outside the scope of classification workflows. This lack of visibility increases the risk of exposure, especially for sensitive data that is not actively used or monitored. \n To tackle this challenge, we are introducing on-demand classification for endpoints. \n Coming to public preview in July, on-demand classification for endpoints gives security teams a targeted way to scan data at rest on Windows devices, without relying on file activity, to uncover sensitive files that have never been classified or reviewed. \n This means you can: \n \n Discover sensitive data on endpoints, including older, unclassified data that may never have been scanned, giving admins visibility into unclassified files that typically fall outside traditional classification workflows \n Support audit and compliance efforts by identifying sensitive data \n Focus scans on specific users, file types, or timelines to get visibility that really matters \n Get insights needed to prioritize remediation or protection strategies \n \n Security teams can define where or what to focus on by selecting specific users, file types, or last modified dates. This allows teams to prioritize scans for high-priority scenarios, like users handling sensitive data. \n Because on-demand classification scans are manually triggered and scoped without complex configuration, organizations can get targeted visibility into sensitive data on endpoints with minimal performance impact and without the need for complex setup. \n \n \n \n Complements just-in-time protection \n On-demand classification for endpoints also works hand-in-hand with existing endpoint DLP capabilities like just-in-time (JIT) protection. \n \n JIT protection kicks in during file access, blocking or alerting based on real-time content evaluation \n On-demand classification works ahead of time, identifying sensitive data that hasn’t been modified or accessed in an extended period \n \n Used together, they form a layered endpoint protection strategy, ensuring full visibility and protection. \n Choosing the right tool \n On-demand classification for endpoints is purpose-built for discovering sensitive data at rest on endpoints, especially files that haven’t been accessed or modified for a long time. It gives admins targeted visibility—no user action required. \n If you’re looking to apply labels, enforce protection policies, or scan files stored on on-premises servers, the Microsoft Purview Information Protection Scanner may be a better fit. It is designed for ongoing policy enforcement and label application across your hybrid environment. Learn more here. \n Get started with on-demand classification \n On-demand classification is easy to set up, with no agents to install or complex rules to configure. It only runs when you choose, rather than continuously running in the background. You stay in control of when and where scans happen, making it a simple and efficient way to extend visibility to endpoints. \n On-demand classification for endpoints enters public preview in July. Stay tuned for setup guidance and more details as we get closer to launch. \n Streamlining technical issue resolution with always-on diagnostics for endpoint devices \n Historically, resolving technical support tickets for Purview DLP required admins to manually collect logs and have end users reproduce the original issue at the time of the request. This could lead to delays, extended resolution times, and repeated communication cycles, especially for non-reproducible issues. \n Today, we’re introducing a new way to capture and share endpoint diagnostics: Always-on diagnostics available in public preview. When submitting support requests for Purview endpoint DLP, customers can now share rich diagnostic data with Microsoft without needing to recreate the issue scenario again at the time of submitting an investigation request such as a support ticket. This capability can now be enabled through your endpoint DLP settings. Learn more about always-on diagnostics here. \n \n Strengthening DLP for Microsoft 365 Copilot \n As organizations adopt Microsoft 365 Copilot, DLP plays a critical role in minimizing the risk of sensitive data exposure through AI. New enhancements give security teams greater control, visibility, and flexibility when protecting sensitive content in Copilot scenarios. \n Expanded protection to labeled emails \n DLP for Microsoft 365 Copilot now supports labeled email, available today, in addition to files in SharePoint and OneDrive. This helps prevent sensitive emails from being processed by Copilot and used as grounding data. This capability is applicable to emails sent after 1/1/2025. \n Alerts and investigations for Copilot access attempts \n \n Security teams can now configure DLP alerts for Microsoft 365 Copilot activity, surfacing attempts to access emails or files with sensitivity labels that match DLP policies. Alert reports include key details like user identity, policy match, and file name, enabling admins to quickly assess what happened, determine if further investigation is needed, and take appropriate follow-up actions. Admins can also choose to notify users directly, reinforcing responsible data use. The rollout will start on June 30 and is expected to be completed by the end of July. \n Simulation mode for Copilot DLP policies \n \n As part of the rollout starting on June 30, simulation mode lets admins test Copilot-specific DLP policies before enforcement. By previewing matches without impacting users, security teams can fine-tune rules, reduce false positives, and deploy policies with greater confidence. \n Learn more about DLP for Microsoft 365 Copilot here. \n Extended protection to more Azure data sources \n AI development is only as secure as the data that feeds it. That’s why Microsoft Purview Information Protection is expanding its auto-labeling capabilities to cover more Azure data sources. \n Now in public preview, security teams can automatically apply sensitivity labels to additional Azure data sources, including Azure Cosmos DB, PostgreSQL, KustoDB, MySQL, Azure Files, Azure Databricks, Azure SQL Managed Instances, and Azure Synapse. \n These additions build on existing coverage for Azure Blob Storage, Azure Data Lake Storage, and Azure SQL Database. These sources commonly fuel analytics pipelines and AI training workloads. With auto-labeling extended to more high-value data sources, sensitivity labels are applied to the data before it’s copied, shared, or integrated into downstream systems. These labels help enforce protection policies and limit unauthorized access to ensure sensitive data is handled appropriately across apps and AI workflows. \n Secure your AI training data, learn how to set up auto-labeling here. \n Extending data security to the network layer \n With more sensitive data moving through unmanaged SaaS apps and personal AI tools, your network is now a critical security surface. \n Earlier this year, we announced the introduction of Purview data security controls for the network layer. With inline data discovery for the network, organizations can detect sensitive data that’s outside of the trusted boundaries of the organization, such as unmanaged SaaS apps and cloud services. \n \n This helps admins understand how sensitive data can be intentionally or inadvertently exfiltrated to personal instances of apps, unsanctioned GenAI apps, cloud storage boxes, and more. This capability is now available in public preview — learn more here. \n \n \n Visibility of sensitive data sent through the network also includes insights into how users may be sharing data in risky ways. User activities such as file uploads or AI prompt submissions are captured in Insider Risk Management to formulate richer and comprehensive profiles of user risk. In turn, these signals will also better contextualize future data interactions and enrich policy verdicts. These user risk indicators will become available in the coming weeks. \n Automate investigation workflows with Alert Triage Agents in DLP and IRM \n Security teams today face a high volume of alerts, often spending hours sorting through false positives and low priority flags to find threats that matter. To help security teams focus on what’s truly high risk, we’re excited to share that the Alert Triage Agents in Microsoft Purview Data Loss Prevention (DLP) and Insider Risk Management (IRM) are now available in public preview. \n These autonomous, Security Copilot-powered agents prioritize alerts that pose the greatest risk to organizations. Whether it’s identifying high-impact exfiltration attempts in DLP or surfacing potential insider threats in IRM, the agents analyze both content and intent to deliver transparent, explainable findings. \n Built to learn and improve from user feedback, these agents not only accelerate investigations, but also improve over time, empowering teams to prioritize real threats, reduce time spent on false positives, and adapt to evolving risks through feedback. Watch the new Mechanics video, or learn more about how to get started here. \n A unified approach to modern data security \n Disjointed security tools create gaps and increase operational overhead. Microsoft Purview offers a unified data security platform designed to keep pace with how your organization works with AI today. \n From endpoints visibility to automated security workflows, Purview unifies data security across your estate, giving you one platform for end-to-end data security. \n As your data estate grows and AI reshapes the way you work, Purview helps you stay ahead—so you can scale securely, reduce risk, and unlock the full productivity potential of AI with confidence. \n Ready to unify your data security into one integrated platform? Try Microsoft Purview free for 90 days. ","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})@stringLength":"12814","kudosSumWeight":2,"repliesCount":0,"readOnly":false,"images":{"__typename":"AssociatedImageConnection","edges":[{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LVhnOUxLcQ?revision=3\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDI","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LUJSUUFIWA?revision=3\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDM","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LU5NMUJKTg?revision=3\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDQ","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LWp3NzNVOA?revision=3\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDU","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LUpPWUdYTQ?revision=3\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDY","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LW5DcVhtTg?revision=3\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDc","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LU13cUdkag?revision=3\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDg","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LWd2cXlURA?revision=3\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDk","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LVJFYlZtag?revision=3\"}"}}],"totalCount":9,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"videos":{"__typename":"VideoConnection","edges":[],"totalCount":0,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"coverImage":{"__typename":"UploadedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDI3MTk1LVhnOUxLcQ?revision=3"},"coverImageProperties":{"__typename":"CoverImageProperties","style":"STANDARD","titlePosition":"BOTTOM","altText":""}},"Conversation:conversation:4122028":{"__typename":"Conversation","id":"conversation:4122028","topic":{"__typename":"BlogTopicMessage","uid":4122028},"lastPostingActivityTime":"2025-06-24T08:54:30.669-07:00","solved":false},"User:user:165398":{"__typename":"User","uid":165398,"login":"Jon_Nordstrom","registrationData":{"__typename":"RegistrationData","status":null},"deleted":false,"avatar":{"__typename":"UserAvatar","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/m_assets/avatars/default/avatar-11.svg?time=0"},"id":"user:165398"},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0N2lBRUUwNUEzREY0Q0QyQTZE?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0N2lBRUUwNUEzREY0Q0QyQTZE?revision=9","title":"JonNordstrm_89-1713948816249.png","associationType":"TEASER","width":2854,"height":1580,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0Mmk4NDhDOTc0MzM2RTY5QTIw?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0Mmk4NDhDOTc0MzM2RTY5QTIw?revision=9","title":"JonNordstrm_84-1713948816198.png","associationType":"BODY","width":144,"height":125,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0M2k4OTZDQkY1OUU2NTlGNjM5?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0M2k4OTZDQkY1OUU2NTlGNjM5?revision=9","title":"JonNordstrm_86-1713948816206.png","associationType":"BODY","width":1007,"height":390,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0Nmk0QzFFMEE4OTkxNTVFNzRF?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0Nmk0QzFFMEE4OTkxNTVFNzRF?revision=9","title":"JonNordstrm_87-1713948816208.png","associationType":"BODY","width":1006,"height":392,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0NWk0MjNCREZGODU5RTc1QTA4?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0NWk0MjNCREZGODU5RTc1QTA4?revision=9","title":"JonNordstrm_88-1713948816210.png","associationType":"BODY","width":711,"height":539,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0OGkxMjkyNTQxNzI4Mzg0NERC?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0OGkxMjkyNTQxNzI4Mzg0NERC?revision=9","title":"JonNordstrm_90-1713948816251.png","associationType":"BODY","width":430,"height":325,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1MGlBRDM3RUI1RjVDQTA0RDJC?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1MGlBRDM3RUI1RjVDQTA0RDJC?revision=9","title":"JonNordstrm_91-1713948816264.png","associationType":"BODY","width":1610,"height":355,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0OWlBRTJFNTZGNzNEMUE2M0Y2?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0OWlBRTJFNTZGNzNEMUE2M0Y2?revision=9","title":"JonNordstrm_92-1713948816271.png","associationType":"BODY","width":2661,"height":247,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1Mmk3RDFFOTVBQjE2RDdGMkIx?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1Mmk3RDFFOTVBQjE2RDdGMkIx?revision=9","title":"JonNordstrm_93-1713948816272.png","associationType":"BODY","width":1542,"height":223,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1MWlFNTcwOUM0OTI0MjUxMzgy?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1MWlFNTcwOUM0OTI0MjUxMzgy?revision=9","title":"JonNordstrm_94-1713948816273.png","associationType":"BODY","width":315,"height":216,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1M2lERDcyNUU4RjA1RTRGM0Qw?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1M2lERDcyNUU4RjA1RTRGM0Qw?revision=9","title":"JonNordstrm_95-1713948816330.png","associationType":"BODY","width":2821,"height":1587,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1NGlCMTBCRTI0RDY2OTY0Rjk3?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1NGlCMTBCRTI0RDY2OTY0Rjk3?revision=9","title":"JonNordstrm_96-1713948816334.png","associationType":"BODY","width":828,"height":559,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1NWlDRkE3MzI0QjBEREQ0QkZC?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1NWlDRkE3MzI0QjBEREQ0QkZC?revision=9","title":"JonNordstrm_97-1713948816348.png","associationType":"BODY","width":2737,"height":1550,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1Nmk5QUFFMDg5NTIzNDIyMDRB?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1Nmk5QUFFMDg5NTIzNDIyMDRB?revision=9","title":"JonNordstrm_98-1713948816375.png","associationType":"BODY","width":2803,"height":1594,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1N2kzREFCMkY0N0Y5MDRFQjM0?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1N2kzREFCMkY0N0Y5MDRFQjM0?revision=9","title":"JonNordstrm_99-1713948816376.png","associationType":"BODY","width":226,"height":111,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1OWk4NEU5ODgxOUVGN0EwQzAx?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1OWk4NEU5ODgxOUVGN0EwQzAx?revision=9","title":"JonNordstrm_100-1713948816388.png","associationType":"BODY","width":1610,"height":355,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1OGlGRkQxQThBMjI4OTMzNkJE?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1OGlGRkQxQThBMjI4OTMzNkJE?revision=9","title":"JonNordstrm_101-1713948816395.png","associationType":"BODY","width":3956,"height":646,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2MWk4MDA0NTk4RjdCRTNDQjZC?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2MWk4MDA0NTk4RjdCRTNDQjZC?revision=9","title":"JonNordstrm_102-1713948816397.png","associationType":"BODY","width":400,"height":120,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2MmlBRTNFNTRDN0Q0NjU2NzRD?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2MmlBRTNFNTRDN0Q0NjU2NzRD?revision=9","title":"JonNordstrm_103-1713948816400.png","associationType":"BODY","width":1210,"height":629,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2M2lGNDlCQTEwRDE3ODQ1NDA4?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2M2lGNDlCQTEwRDE3ODQ1NDA4?revision=9","title":"JonNordstrm_104-1713948816426.png","associationType":"BODY","width":2186,"height":1167,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2NWk5NEU4NTNBOUE3NjM3Rjg4?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2NWk5NEU4NTNBOUE3NjM3Rjg4?revision=9","title":"JonNordstrm_105-1713948816451.png","associationType":"BODY","width":2133,"height":1141,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2NGkwODM5RkZEREQ0M0UyNzBE?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2NGkwODM5RkZEREQ0M0UyNzBE?revision=9","title":"JonNordstrm_106-1713948816453.png","associationType":"BODY","width":315,"height":216,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2Nmk5NkJBMzEwMTZFRDY1Mjg5?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2Nmk5NkJBMzEwMTZFRDY1Mjg5?revision=9","title":"JonNordstrm_107-1713948955268.png","associationType":"BODY","width":3010,"height":1636,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2OGk2MUE2REI0MDU1MTY2RDg2?revision=9\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2OGk2MUE2REI0MDU1MTY2RDg2?revision=9","title":"JonNordstrm_108-1713948955298.png","associationType":"BODY","width":3043,"height":1556,"altText":null},"BlogTopicMessage:message:4122028":{"__typename":"BlogTopicMessage","subject":"How to build the Microsoft Purview extended report experience","conversation":{"__ref":"Conversation:conversation:4122028"},"id":"message:4122028","revisionNum":9,"uid":4122028,"depth":0,"board":{"__ref":"Blog:board:microsoft-security-blog"},"author":{"__ref":"User:user:165398"},"teaser@stripHtml({\"removeProcessingText\":true,\"truncateLength\":-1})":" This is a step-by-step guided walkthrough of the extended report experience. \n ","introduction":"","metrics":{"__typename":"MessageMetrics","views":11401},"postTime":"2024-08-21T10:50:15.712-07:00","lastPublishTime":"2024-08-21T10:52:49.772-07:00","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})":" This is a step-by-step guided walkthrough of the extended report experience. \n \n Prerequisites \n \n License requirements for Microsoft Purview Information Protection depend on the scenarios and features you use. To understand your licensing requirements and options for Microsoft Purview Information Protection, see the Information Protection sections from Microsoft 365 guidance for security & compliance and the related PDF download for feature-level licensing requirements. \n Before you start, all endpoint interaction with Sensitive content is already being included in the audit logging with Endpoint DLP enabled. For Microsoft 365 SharePoint, OneDrive Exchange, Teams you can enable policies that generate events but not incidents for important sensitive information types. \n Install Power BI Desktop to make use of the templates Downloads | Microsoft Power BI \n \n \n Step-by-step guided walkthrough \n In this guide, we will provide high-level steps to get started using the new tooling. \n \n Get the latest version of the report that you are interested in from here. In this case we will show the Board report. \n Open the report if Power BI Desktop is installed it should look like this. \n \n \n \n \n You may have to approve the use of ArcGIS Maps if that has not been done before. \n \n \n \n \n You must authenticate with https://api.security.microsoft.com, select Organizational account, and sign in. Then click Connect. \n \n \n \n \n You will also have to authenticate with httpps://api.security.microsoft.com/api/advancedhunting, select Organizational account, and sign in. Then click Connect. \n \n \n \n \n The system will start to collect the information from the built-in queries. Please note that this can take quite some time in larger environments. \n \n \n \n \n When the load completes you should see something like this, in the Legal and Compliance tab. The report provides details on all content that is matching, built-in, and custom Sensitivity types, or any that have been touched by any of the compromised User accounts or Devices in the red box. The report needs to be updated. \n \n \n \n \n 7.1 All the reports have diagrams to measure KPI’s that measure the progress of improvement projects. Sample above is in the grey box, where it is measured based on how much sensitive content is accessed by compromised users or devices. This should be adjusted to be based on what resonates with your key objectives. \n 7.2 The green boxes used for the KPI measurements come from MaxDataSensitiveRisk, MaxDataDevice, MaxDataUser. You can either add a new value or update the current value. \n \n \n \n 7.2.1 To update the current value by selecting Transform data. \n \n \n \n 7.2.2 Select Goals, click on the flywheel for Source. \n \n \n \n 7.2.3 You can now update the values that are stored in the template. If you want to use a different value, you can click the + sign to add additional columns. \n \n \n \n 7.2.4 When you have made the modifications click Close & Apply. \n \n \n \n 7.3 Update the blue box high-level description to match the content or replace it with something automatically generated by Copilot, https://learn.microsoft.com/en-us/power-bi/create-reports/copilot-introduction. \n \n 7.4 Based on the organization's requirements filter to only the required Sensitive information types. \n \n \n \n 7.5 The last part that you may want to update is the incident diagrams. By default, they show the severity and type of attack for incidents linked to access to sensitive data. You may want to map this to incident Tags or other fields based on your requirements. \n \n \n \n \n The Trust & Reputation got a similar build as the Legal and compliance scorecard. Update it based on the requirements for your use case. The initial idea for this report is to show privacy-related data. The impact of having customer data leaking is devastating for the Trust customers have for the organization. Other reputational data points should be added as needed. \n \n \n \n \n \n The Company & Shareholder Value contains some more information. The goal is to customize this to be bound to the organization's secrets. Secret drawings, source code, internal financial results dashboards, supply chains, product development and other sensitive information. You may want to filter down to EDM, Fingerprint type SITs and specific trainable classifiers for this report. \n \n \n \n \n 9.1 To receive the accurate mapping of the labelled content you need to update the MIPLabel table with your label names and GUIDs. \n \n \n \n 9.1.2 Select Transform data. \n \n \n \n 9.1.3 Select MIPLabel, click on the flywheel for Source. \n \n \n \n 9.1.4 Connect to SCC PowerShell (Connect-IPPSsession) \n -Run get-label | select immutableid, DisplayName \n -Copy the Output \n \n \n \n \n 9.1.5 You can now update the values that are stored in the template. This ensures that the name mapping of labels works as expected. \n \n \n \n 9.1.6 The next step is to update the Access to mission-critical systems from compromised devices. Select the SensitiveSystems query. Then click Advanced Editor \n \n \n \n 9.1.7 Update the list of URLs that contain a system that has high business impact if an attacker has been accessing it. It is important to only use single quotes. Right now, there is no straightforward way to capture the URLs, so we need to do it manually. Once complete click Done. \n \n \n \n 9.1.8 When completed, click Close & Apply \n \n \n \n \n \n If the previous steps have been completed the tab for operational scope should be ok. This view provides the organization with information about where Sensitive information is processed. This can help the organization to identify from where the content is being processed by which legal entity and function etc…. Failing this may in fact directly impact if an organization is allowed to operate in a specific market or not. Not knowing this have impact on restructuring the company and other actions to keep the company competitive. \n \n \n \n 10.1 We have one additional tab that does this based on Sensitivity labels. Called Operational Scope Classified Content. \n \n \n \n 11. The KPI tabs are more condensed and should be customized to fit with the context of the organization and the leaders to which the information is presented. The key thing is to communicate the information in a context that resonates. \n \n \n \n 11.1 You will want to update the incident view highlighted in red, switch it to something that works with the audience, it may be one of the Tags or other detail. You also want to be very deliberate about which incidents should generate the data to be shown in this dashboard. One way is to use tags, you may elect to only show incidents that are tagged with PossibleBoard as an example. This may enhance the communication between security teams and the board. By bringing awareness to the analysts the importance of their work and direct correlation with organizational leadership. \n \n \n \n 11.2 In this sample we have Credit Card in Focus and End user Identifiable, you should replace this with regulator names and the associated sensitive information types. Like SEC, FDA, FCC, NTIA, FCA etc. change the name and update the sensitive information filter. \n \n \n \n \n Additional reports that come with this package \n We are shipping a few additional reports that can be used to gain further insights. The Project sample provides this view for label usage. You can modify the targets similarly to you did for the board report. \n \n \n \n One additional tip for this report is that you can, \n \n Configure the “Maximum value” to be your target value, create the value in the Goals table. \n Set the “Target value” to the value you had over the past period 275 in the case above. \n \n \n \n While the incident sample will provide views like this. The incident reporting and progress view provides insights into the analyst process. It provides the overall efficiency metrics and measures to gauge the performance. It provides incident operations over time by different criteria, like severity, mean time to triage, mean time to resolve, DLP Policy, and more. You should customize this view to work with your practices. \n \n \n \n The Incident view is by default 6 months while the event data is from the past 30 days. To increase the event data beyond 30 days you can use Microsoft Sentinel. If you on the other hand want to reduce the Incident window you can follow these steps. \n \n Go to transform data \n Select the Incident table, view settings by default you will see. \n \n \n \n \n Update this to 30 days by updating the value to this as an example. \n \n \n \n 4. = OData.Feed(\"https://api.security.microsoft.com/api/incidents?$filter=lastUpdateTime gt \" & Date.ToText(Date.AddDays(Date.From(DateTime.LocalNow()),-30), \"yyyy-MM-dd\") , null, [Implementation=\"2.0\"]) \n \n The report also has a per workload detailed view like this sample for Exchange Online. The report contains Exchange, SharePoint, OneDrive for Business, Endpoint, Teams and OCR. \n \n \n \n \n Additional configuration to be made \n This is required to capture sensitive information that is transferred in Exchange Online or SharePoint Online. Setup captures all DLP policies that do not have any action or raise any alerts. This is also important for the Copilot for Security functionality to work correctly. \n \n Create a custom policy. \n \n \n \n \n Name the policy based on your naming standard and provide a description of the policy. \n \n \n \n \n Select the workloads from where you want to capture sensitive data usage. For devices there is no need, devices are capturing all the sensitive data processing by default. \n \n \n \n \n Click next. \n \n \n \n \n Click Create rule. \n \n \n \n \n Provide a rule name and click Add condition, then click Content Contains \n \n \n \n \n \n Then click Sensitive info types, and select all the relevant Sensitive information types that you would like to capture for both internal and external processing. Note, do focus on the sensitive information types that are key to your operations (max 125 per rule). Then click Add, you can add your own custom SITs or make use of the built in SITs. \n \n \n \n \n If you want any other conditions to be true for generating signals like external communications add that condition. Next, ensure that no Action, User notifications, Incident reports or Use email incident reports… are turned on. They should all be turned off. \n \n \n \n Setup the Power BI online view \n Providing an online view of the data has several benefits. You can delegate access to the dashboard without delegating permissions to the underlying data set. You can also create queries that only show information for a specific division or market and only present that information to that specific market. You can set up a scheduled refresh to refresh the data without having to upload it again. \n Follow these steps to set up the integration https://learn.microsoft.com/en-us/azure/sentinel/powerbi#create-a-power-bi-online-workspace. \n \n Posts part of this series \n \n Cyber Security in a context that allows your organization to achieve more https://techcommunity.microsoft.com/t5/security-compliance-and-identity/cyber-security-in-a-context-that-allows-your-organization-to/ba-p/4120041 \n Security for Copilot Data Security Analyst plugin https://techcommunity.microsoft.com/t5/security-compliance-and-identity/learn-how-to-customize-and-optimize-copilot-for-security-with/ba-p/4120147 \n Guided walkthrough of the Microsoft Purview extended report experience https://techcommunity.microsoft.com/t5/security-compliance-and-identity/guided-walkthrough-of-the-microsoft-purview-extended-report/ba-p/4121083 \n ","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})@stringLength":"12401","kudosSumWeight":3,"repliesCount":9,"readOnly":false,"images":{"__typename":"AssociatedImageConnection","edges":[{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0N2lBRUUwNUEzREY0Q0QyQTZE?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDI","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0Mmk4NDhDOTc0MzM2RTY5QTIw?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDM","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0M2k4OTZDQkY1OUU2NTlGNjM5?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDQ","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0Nmk0QzFFMEE4OTkxNTVFNzRF?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDU","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0NWk0MjNCREZGODU5RTc1QTA4?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDY","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0N2lBRUUwNUEzREY0Q0QyQTZE?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDc","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0OGkxMjkyNTQxNzI4Mzg0NERC?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDg","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1MGlBRDM3RUI1RjVDQTA0RDJC?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDk","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk0OWlBRTJFNTZGNzNEMUE2M0Y2?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDEw","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1Mmk3RDFFOTVBQjE2RDdGMkIx?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDEx","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1MWlFNTcwOUM0OTI0MjUxMzgy?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDEy","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1M2lERDcyNUU4RjA1RTRGM0Qw?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDEz","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1NGlCMTBCRTI0RDY2OTY0Rjk3?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE0","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1NWlDRkE3MzI0QjBEREQ0QkZC?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE1","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1Nmk5QUFFMDg5NTIzNDIyMDRB?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE2","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1N2kzREFCMkY0N0Y5MDRFQjM0?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE3","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1OWk4NEU5ODgxOUVGN0EwQzAx?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE4","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk1OGlGRkQxQThBMjI4OTMzNkJE?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE5","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2MWk4MDA0NTk4RjdCRTNDQjZC?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDIw","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2MmlBRTNFNTRDN0Q0NjU2NzRD?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDIx","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2M2lGNDlCQTEwRDE3ODQ1NDA4?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDIy","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2NWk5NEU4NTNBOUE3NjM3Rjg4?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDIz","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2NGkwODM5RkZEREQ0M0UyNzBE?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDI0","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2Nmk5NkJBMzEwMTZFRDY1Mjg5?revision=9\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDI1","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MTIyMDI4LTU3Mzk2OGk2MUE2REI0MDU1MTY2RDg2?revision=9\"}"}}],"totalCount":42,"pageInfo":{"__typename":"PageInfo","hasNextPage":true,"endCursor":"MjUuM3wyLjF8b3wyNXxfTlZffDI1","hasPreviousPage":false,"startCursor":null}},"videos":{"__typename":"VideoConnection","edges":[],"totalCount":0,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"coverImage":null,"coverImageProperties":{"__typename":"CoverImageProperties","style":"STANDARD","titlePosition":"BOTTOM","altText":""}},"Conversation:conversation:4215184":{"__typename":"Conversation","id":"conversation:4215184","topic":{"__typename":"BlogTopicMessage","uid":4215184},"lastPostingActivityTime":"2025-06-04T03:26:56.189-07:00","solved":false},"User:user:1032848":{"__typename":"User","uid":1032848,"login":"ninachen","registrationData":{"__typename":"RegistrationData","status":null},"deleted":false,"avatar":{"__typename":"UserAvatar","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/dS0xMDMyODQ4LTYwODMwMGlBNDhCRTc4OUUxRDUxRDU0"},"id":"user:1032848"},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTIxMmk2MkNBMjdCRTdCMzQ4OTZD?revision=10\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTIxMmk2MkNBMjdCRTdCMzQ4OTZD?revision=10","title":"Thumbnail image.jpg","associationType":"TEASER","width":9504,"height":6336,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTIxM2kzRjhBNjBCMTM1NEIwNjdF?revision=10\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTIxM2kzRjhBNjBCMTM1NEIwNjdF?revision=10","title":"FrequentCollaboratorAnimation.gif","associationType":"BODY","width":1920,"height":1080,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTY0N2k3RURERjQ1QTNEMkREMzg5?revision=10\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTY0N2k3RURERjQ1QTNEMkREMzg5?revision=10","title":"SensitivityLabel.jpeg","associationType":"BODY","width":1597,"height":918,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTY0Nmk4NDcxNDM0MzgwRjRCQjNF?revision=10\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTY0Nmk4NDcxNDM0MzgwRjRCQjNF?revision=10","title":"SIT.jpeg","associationType":"BODY","width":1597,"height":918,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTY1MGkyRkZFNDM0QzMwRkMzRjc0?revision=10\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTY1MGkyRkZFNDM0QzMwRkMzRjc0?revision=10","title":"CopilotNL2KeyQL.gif","associationType":"BODY","width":1920,"height":1080,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTY1MWlCRkNBNUU3Q0ZGQjk1ODBE?revision=10\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTY1MWlCRkNBNUU3Q0ZGQjk1ODBE?revision=10","title":"CopilotSummarizationGIF.gif","associationType":"BODY","width":1920,"height":1080,"altText":null},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTY1M2k1RkEyRUQyQTU4RjVDMzdF?revision=10\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTY1M2k1RkEyRUQyQTU4RjVDMzdF?revision=10","title":"ProgressBar.gif","associationType":"BODY","width":1920,"height":1080,"altText":null},"BlogTopicMessage:message:4215184":{"__typename":"BlogTopicMessage","subject":"eDiscovery launches a modern, intuitive user experience","conversation":{"__ref":"Conversation:conversation:4215184"},"id":"message:4215184","revisionNum":10,"uid":4215184,"depth":0,"board":{"__ref":"Blog:board:microsoft-security-blog"},"author":{"__ref":"User:user:1032848"},"teaser@stripHtml({\"removeProcessingText\":true,\"truncateLength\":-1})":" Announcing a new, intuitive, unified user experience for eDiscovery. ","introduction":"","metrics":{"__typename":"MessageMetrics","views":10309},"postTime":"2024-08-12T09:06:53.190-07:00","lastPublishTime":"2024-08-14T15:16:16.185-07:00","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})":" This month, we are launching a redesigned Microsoft Purview eDiscovery product experience in public preview. This improved user experience revolutionizes your data search, review and export tasks within eDiscovery. Our new user-friendly and feature-rich eDiscovery experience is not just about finding and preserving data, it's about doing it with unprecedented efficiency and ease. The modern user experience of eDiscovery addresses some long-standing customer requests, such as enhanced search capabilities with MessageID, Sensitive Information Types (SITs) and sensitivity labels. It also introduces innovative features like draft query with Copilot and search using audit log. These changes, driven by customer feedback and our commitment to innovation, offer tangible value by saving time and reducing costs in the eDiscovery process.  \n \n The new eDiscovery experience is exclusively available in the Microsoft Purview portal. The new Microsoft Purview portal is a unified platform that streamlines data governance, data security, and data compliance across your entire data estate. It offers a more intuitive experience, allowing users to easily navigate and manage their compliance needs. \n \n Unified experience \n One of the benefits of the new improved eDiscovery offers a unified, consistent, and intuitive experience across different licensing tiers. Whether your license includes eDiscovery standard or premium, you can use the same workflow to create cases, conduct searches, apply holds, and export data. This simplifies the training and education process for organizations that upgrade their license and want to access premium eDiscovery features. Unlike the previous experience, where Content Search, eDiscovery (Standard), and eDiscovery (Premium) had different workflows and behaviors, the new experience lets you access eDiscovery capabilities seamlessly regardless of your license level. E5 license holders have the option to use premium features such as exporting cloud attachments and Teams conversation threading at the appropriate steps in the workflow. Moreover, users still have access to all existing Content Searches and both Standard and Premium eDiscovery cases on the unified eDiscovery case list page in the Microsoft Purview portal. \n \n The new experience also strengthens the security controls for Content Search by placing them in an eDiscovery case. This allows eDiscovery administrators to control who can access and use existing Content Searches and generated exports. Administrators can add or remove users from the Content Search case as needed. This way, they can prevent unauthorized access to sensitive search data and stop Content Search when it is no longer required. Moreover, this helps maintain the integrity and confidentiality of the investigation process. The new security controls ensure that only authorized personnel can access sensitive data, reducing the risk of data breaches and complying with legal and regulatory standards. \n \n Enhanced data source management \n Efficient litigation and investigation workflows hinge on the ability to precisely select data sources and locations in the eDiscovery process. This enables legal teams to swiftly preserve relevant information and minimize the risk of missing critical evidence. The improved data source picking capability allows for a more targeted and effective search, which is essential in responding to legal matters or internal investigations. It enables users to apply holds and conduct searches with greater accuracy, ensuring that all pertinent information is captured without unnecessary data proliferation. This improvement not only enhances the quality of the review, but also reduces the overall costs associated with data storage and management. \n \n The new eDiscovery experience makes data source location mapping and management better as well. You can now perform a user or group search with different identifiers and see their data hierarchy tree, including their mailbox and OneDrive. For example, eDiscovery users can use any of the following identifiers: Name, user principal name (UPN), SMTP address, or OneDrive URL. The data source picker streamlines the eDiscovery workflow by displaying all potential matches and their locations, along with related sources such as frequent collaborators, group memberships, and direct reports. This allows for the addition of these sources to search or hold scope without relying on external teams for information on collaboration patterns, Teams/Group memberships, or organizational hierarchies. \n \n \n The \"sync\" capability in the new data source management flow is a significant addition that ensures eDiscovery users are always informed about the latest changes in data locations. With this feature, users can now query whether a specific data source has newly provisioned data locations or if any have been removed. For example, if a private channel is created for a Teams group, this feature alerts eDiscovery users to the new site's existence, allowing them to quickly and easily include it in their search scope, ensuring no new data slips through the cracks. This real-time update capability empowers users to make informed decisions about including or excluding additional data locations in their investigations. This capability ensures that their eDiscovery process remains accurate and up-to-date with the latest data landscape changes. It is a proactive approach to data management that enhances the efficiency and effectiveness of eDiscovery operations, providing users with the agility to adapt to changes swiftly. \n \n Improved integration with Microsoft Information Protection \n The new eDiscovery experience now supports querying by Sensitive Information Types (SITs) and sensitivity labels. Labeling, classifying, and encrypting your organization's data is a best practice that serves multiple essential purposes. It helps to ensure that sensitive information is handled appropriately, reducing the risk of unauthorized access and data breaches. By classifying data, organizations can apply the right level of protection to different types of information, which is crucial for compliance with various regulations and standards. Moreover, encryption adds a layer of security that keeps data safe even if it falls into the wrong hands. It ensures that only authorized users can access and read the information, protecting it from external threats and internal leaks.  \n \n The new eDiscovery search functionality supports searches for emails and documents classified by SITs or specific sensitivity labels, facilitating the collection and review of data aligned with its classification for thorough investigations. This capability compresses the volume of evidence required for review, significantly reducing both the time and cost of the process. The support of efficient document location and management by targeting specific sensitivity labels unlocks the ability for organizations to validate and understand how sensitivity labels are utilized. This is exemplified by the ability to conduct collections across locations or the entire tenant for a particular label, using the review set to assess label application. Additionally, combining this with SIT searches helps verify correct data classification. For example, it ensures that all credit card data is appropriately labeled as highly confidential by reviewing items containing credit card data that are not marked as such, thereby streamlining compliance and adherence to security policies. \n \n Enhanced investigation capabilities \n The new eDiscovery experience introduces a powerful capability to expedite security investigations, particularly in scenarios involving a potentially compromised account. By leveraging the ability to search by audit log, investigators can swiftly assess the account's activities, pinpointing impacted files. As part of the investigative feature, eDiscovery search can also make use of evidence file as search input. It enables a rapid analysis of file content patterns or signatures. This feature is crucial for identifying similar or related content, providing a streamlined approach to discover if sensitive files have been copied or moved, thereby enhancing the efficiency and effectiveness of the security response. \n \n The enhanced search capability by identifier in the new eDiscovery UX is a game-changer for customers, offering a direct route to the exact message or file needed. With the ability to search using a messageID for mailbox items or a path for SharePoint items, users can quickly locate and retrieve the specific item they require. This precision not only streamlines evidence collection but also accelerates the process of purging leaked data for spillage cleanup. It's a significant time-saver that simplifies the workflow, allowing customers to focus on what matters most – securing and managing their digital environment efficiently, while targeting relevant data. \n \n Building on the data spillage scenario, our search and purge tool for mailbox items, including Teams messages, also received a significant 10x enhancement. Where previously administrators could only purge 10 items per mailbox location, they can now purge up to 100 items per mailbox location. This enhancement is a benefit for administrators tasked with responding to data spills or needing to remediate data within Teams or Exchange, allowing for a more comprehensive and efficient purge process. With all these investigative capability updates, now the security operations team is ready to embrace the expanded functionality and take their eDiscovery operations to the next level. \n \n Microsoft Security Copilot capabilities \n The recently released Microsoft Security Copilot's capabilities in eDiscovery are transformative, particularly in generating KeyQL from natural language and providing contextual summarization and answering abilities in review sets. These features significantly lower the learning curve for KeyQL, enabling users to construct complex queries with ease. Instead of mastering the intricacies of KeyQL, users can simply describe what they are looking for using natural language, and Copilot translates that into a precise KeyQL statement. This not only saves time but also makes the power of eDiscovery accessible to a broader range of users, regardless of their technical expertise. \n   \n \n Moreover, Copilot's summarization skills streamline the review process by distilling key insights from extensive datasets. Users can quickly grasp the essence of large volumes of data, which accelerates the review process and aids in identifying the most pertinent information. This is particularly beneficial in legal and compliance contexts, where time is often of the essence, and the ability to rapidly process and understand information can have significant implications. \n   \n Additional export options \n The new eDiscovery experience introduces a highly anticipated suite of export setting enhancements. The contextual conversation setting is now distinct from the conversation transcript setting, offering greater flexibility in how Teams conversations are exported. The ability to export into a single PST allows for the consolidation of files/items from multiple locations, simplifying the post-export workflow. Export can now give friendly names to each item, eliminating the need for users to decipher item GUIDs, and making identification straightforward. Truncation in export addresses the challenges of zip file path character limits. Additionally, the expanded versioning options empower users to include all versions or select the latest 10 or 100, providing tailored control over the data. These improvements not only meet user expectations but also significantly benefit customers by streamlining the eDiscovery process and enhancing overall efficiency. \n \n Additional enhancements \n As part of the new experience, we are introducing the review set query report, which generates a hit-by-term report based on a KQL query. This query report allows users to quickly see the count and volume of items hit on a particular keyword or a list of compound queries, and can be optionally downloaded.  By providing a detailed breakdown of where and how often each term appears, it streamlines the review by focusing on the most relevant documents, reducing the volume of data that needs to be manually reviewed, and offers a better understanding of which terms may be too broad or too narrow. \n \n As part of the improved user experience, all long-running processes now show a transparent and informative progress bar. This progress bar provides users with real-time visibility into the status of their searches and exports, allowing eDiscovery practitioners to better plan their workflow and manage their time effectively. This feature is particularly beneficial in the context of legal investigations, where timing is often critical, and users need to anticipate when they can proceed to the next steps. This level of process transparency allows users to stay informed and make decisions accordingly. \n \n In addition to progress transparency, all processes in the new eDiscovery experience will include a full report detailing the information related to completed processes. The defensibility of eDiscovery cases and investigations is paramount. The full reporting capabilities for processes such as exports, searches, and holds provide critical transparency. For example, it allows for a comprehensive audit of what was searched or exported, the specific timing, and the settings used. For customers, this means a significant increase in trust and defensibility of the eDiscovery process. This enhancement not only bolsters the integrity of the eDiscovery process but also reinforces the commitment to delivering customer-centric solutions that meet the rigorous demands of legal compliance and data management. \n \n Hold policy detail view also received an upgrade as part of this new eDiscovery release. Customers now can access the hold policy view with detailed information on all locations and their respective hold status. This detailed view is instrumental in providing a transparent audit of what location is on hold, ensuring that all relevant data is preserved, and that no inadvertent destruction of evidence occurs during the process. Customers can download and analyze the full detailed hold location report, ensuring that all necessary content is accounted for and that legal obligations are met. \n \n As we conclude this exploration of the modernized Microsoft Purview eDiscovery (preview) experience, it's clear that the transformative enhancements are set to redefine the landscape of legal compliance and security investigations. The new experience, with its intuitive design and comprehensive set of new capabilities, streamlines the eDiscovery process, making it more efficient and accessible than ever before. The new eDiscovery experience is currently in public preview and is expected to be Generally Available by the end of 2024. \n \n Thank you for joining us on this journey through the latest advancements in eDiscovery. We are excited to see how these changes will empower legal and compliance teams to achieve new levels of efficiency and effectiveness in their important work. To learn more about the changes in eDiscovery, visit our product documentation. As always, we are eager to hear your feedback and continue innovating to improve your experience. We welcome your thoughts via the Microsoft Purview portal’s feedback button. \n \n We hope these enhancements improve your day-to-day experience and ultimately streamline the eDiscovery process, making it more efficient and accessible than ever before. The new eDiscovery experience is currently in public preview and is expected to be Generally Available by the end of 2024. \n \n Learn more \n Rollout has begun and is expected to reach all worldwide tenants by mid September. We are excited to see how these changes will empower legal and compliance teams to achieve new levels of efficiency and effectiveness in their important work. Check out our interactive guide at https://aka.ms/eDiscoverynewUX to better understand the changes in eDiscovery. As always, we are eager to hear your feedback and continue innovating to improve your experience. We welcome your thoughts via the Microsoft Purview portal’s feedback button. \n \n To learn more about thew new eDiscovery user experience, visit our Microsoft documentation at https://aka.ms/ediscoverydocsnew. If you have yet to try eDiscovery, visit the new Purview portal today to start a trial. For more updates on the future of eDiscovery, check out our product roadmap. ","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})@stringLength":"17086","kudosSumWeight":6,"repliesCount":7,"readOnly":false,"images":{"__typename":"AssociatedImageConnection","edges":[{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTIxMmk2MkNBMjdCRTdCMzQ4OTZD?revision=10\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDI","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTIxM2kzRjhBNjBCMTM1NEIwNjdF?revision=10\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDM","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTY0N2k3RURERjQ1QTNEMkREMzg5?revision=10\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDQ","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTY0Nmk4NDcxNDM0MzgwRjRCQjNF?revision=10\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDU","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTY1MGkyRkZFNDM0QzMwRkMzRjc0?revision=10\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDY","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTY1MWlCRkNBNUU3Q0ZGQjk1ODBE?revision=10\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDc","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MjE1MTg0LTYwOTY1M2k1RkEyRUQyQTU4RjVDMzdF?revision=10\"}"}}],"totalCount":7,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"videos":{"__typename":"VideoConnection","edges":[],"totalCount":0,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"coverImage":null,"coverImageProperties":{"__typename":"CoverImageProperties","style":"STANDARD","titlePosition":"BOTTOM","altText":""}},"Conversation:conversation:4419783":{"__typename":"Conversation","id":"conversation:4419783","topic":{"__typename":"BlogTopicMessage","uid":4419783},"lastPostingActivityTime":"2025-06-02T13:15:46.743-07:00","solved":false},"User:user:1709414":{"__typename":"User","uid":1709414,"login":"MannySahota","registrationData":{"__typename":"RegistrationData","status":null},"deleted":false,"avatar":{"__typename":"UserAvatar","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/dS0xNzA5NDE0LU5ZcW93OQ?image-coordinates=0%2C110%2C509%2C619"},"id":"user:1709414"},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE5NzgzLUc2OXhkYg?revision=2\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE5NzgzLUc2OXhkYg?revision=2","title":"Security-Texture-TechScan-Yellow-04.jpg","associationType":"COVER","width":4096,"height":2304,"altText":""},"BlogTopicMessage:message:4419783":{"__typename":"BlogTopicMessage","subject":"“Build Your Own” M365 Copilot DPIA templates for public sector and enterprise organizations","conversation":{"__ref":"Conversation:conversation:4419783"},"id":"message:4419783","revisionNum":2,"uid":4419783,"depth":0,"board":{"__ref":"Blog:board:microsoft-security-blog"},"author":{"__ref":"User:user:1709414"},"teaser@stripHtml({\"removeProcessingText\":true,\"truncateLength\":-1})":"","introduction":"","metrics":{"__typename":"MessageMetrics","views":1322},"postTime":"2025-06-02T13:15:46.743-07:00","lastPublishTime":"2025-06-02T13:15:46.743-07:00","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})":" In April, Microsoft launched our “Build Your Own” Data Protection Impact Assessment templates for Office 365 as part of our commitment to helping our customers embrace new cutting-edge technologies while providing the information they need to continue to meet their compliance obligations. Today, we’re excited to expand that commitment into the era of AI, as we share our new “Build Your Own” Data Protection Impact Assessment templates for Microsoft’s AI-powered productivity service, Microsoft 365 Copilot. \n These “Build Your Own” DPIAs—for both public sector and enterprise customers—are customizable and illustrative template guides that Microsoft has produced, with references to our Product Terms, Data Protection Addendum (“DPA”), and Microsoft’s extensive documentation for M365 Copilot. They are designed to help public sector organizations systematically identify, assess, and address potential data protection risks, making it easier to evaluate compliance with the GDPR. \n As AI technologies rapidly evolve, and uses of that technology with it, we recognize that compliance tools like the “Build Your Own” DPIA will need to evolve, too. As such, we are committed to continually refining and improving the document, including based on customer feedback, with the goal of helping make our customers’ AI transformation compliance journey as friction-free as possible. \n \n Download the templates here: \n “Build Your Own” M365 Copilot Data Protection Impact Assessment for the Public Sector \n “Build Your Own” M365 Copilot Data Protection Impact Assessment for Enterprise Customers ","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})@stringLength":"1647","kudosSumWeight":0,"repliesCount":0,"readOnly":false,"images":{"__typename":"AssociatedImageConnection","edges":[{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE5NzgzLUc2OXhkYg?revision=2\"}"}}],"totalCount":1,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"videos":{"__typename":"VideoConnection","edges":[],"totalCount":0,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"coverImage":{"__typename":"UploadedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE5NzgzLUc2OXhkYg?revision=2"},"coverImageProperties":{"__typename":"CoverImageProperties","style":"STANDARD","titlePosition":"BOTTOM","altText":""}},"Conversation:conversation:4416759":{"__typename":"Conversation","id":"conversation:4416759","topic":{"__typename":"BlogTopicMessage","uid":4416759},"lastPostingActivityTime":"2025-05-27T09:00:00.012-07:00","solved":false},"User:user:2030079":{"__typename":"User","uid":2030079,"login":"AnjaleePatel","registrationData":{"__typename":"RegistrationData","status":null},"deleted":false,"avatar":{"__typename":"UserAvatar","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/dS0yMDMwMDc5LTU3MDA4NGk2QkI0Qjc4Qjc5ODQ3QTU4"},"id":"user:2030079"},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE2NzU5LTQ4NVhDZA?revision=12\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE2NzU5LTQ4NVhDZA?revision=12","title":"Screenshot 2025-05-23 003802.png","associationType":"COVER","width":941,"height":605,"altText":""},"BlogTopicMessage:message:4416759":{"__typename":"BlogTopicMessage","subject":"Rethinking Data Security and Governance in the Era of AI","conversation":{"__ref":"Conversation:conversation:4416759"},"id":"message:4416759","revisionNum":12,"uid":4416759,"depth":0,"board":{"__ref":"Blog:board:microsoft-security-blog"},"author":{"__ref":"User:user:2030079"},"teaser@stripHtml({\"removeProcessingText\":true,\"truncateLength\":-1})":"","introduction":"","metrics":{"__typename":"MessageMetrics","views":1177},"postTime":"2025-05-27T09:00:00.012-07:00","lastPublishTime":"2025-05-27T09:00:00.012-07:00","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})":" The era of AI is reshaping industries, enabling unprecedented innovations, and presenting new opportunities for organizations worldwide. But as organizations accelerate AI adoption, many are focused on a growing concern: their current data security and governance practices are not effectively built for the fast-paced AI innovation and ever-evolving regulatory landscape. \n At Microsoft, we recognize the critical need for an integrated approach to address these risks. In our latest findings, Top 3 Challenges in Securing and Governing Data for the Era of AI, we uncovered critical gaps in how organizations manage data risk. The findings exemplify the current challenges: 91% of leaders are not prepared to manage risks posed by AI 1 and 85% feel unprepared to comply with AI regulations 2 . These gaps not only increase non-compliance but also put innovation at risk. \n Microsoft Purview has the tools to tackle these challenges head on, helping organizations move to an approach that protects data, meets compliance regulations, and enables trusted AI transformation. We invite you to take this opportunity to evaluate your current practices, platforms, and responsibilities, and to understand how to best secure and govern your organization for growing data risks in the era of AI. \n Platform fragmentation continues to weaken security outcomes \n Organizations often rely on fragmented tools across security, compliance, and data teams, leading to a lack of unified visibility and insufficient data hygiene. Our findings reveal the effects of fragmented platforms, leading to duplicated data, inconsistent classification, redundant alerts, and siloed investigations, which ultimately is causing data exposure incidents related to AI to be on the rise 3 . \n Microsoft Purview offers centralized visibility across your organization’s data estate. This allows teams to break down silos, streamline workflows, and mitigate data leakage and oversharing. With Microsoft Purview, capabilities like data health management and data security posture management are designed to enhance collaboration and deliver enriched insights across your organization to help further protect your data and mitigate risks faster. \n Microsoft Purview offers the following: \n \n Unified insights across your data estate, breaking down silos between security, compliance, and data teams. Microsoft Purview Data Security Posture Management (DSPM) for AI helps organizations gain unified visibility into GenAI usage across users, data, and apps to address the heightened risk of sensitive data exposure from AI. \n Built-in capabilities like classification, labeling, data loss prevention, and insider risk insights in one platform. In addition, newly launched solutions like Microsoft Purview Data Security Investigations accelerate investigations with AI-powered deep content analysis, which helps data security teams quickly identify and mitigate sensitive data and security risks within impacted data. \n \n Organizations like Kern County historically relied on many fragmented systems but adopted Microsoft Purview to unify their organization’s approach to data protection in preparation for increasing risks associated with deploying GenAI. \n \n “We have reduced risk exposure, [Microsoft] Purview helped us go from reaction to readiness. We are catching issues proactively instead of retroactively scrambling to contain them.” \n – Aaron Nance, Deputy Chief Information Security Officer, Kern County \n \n Evolving regulations require continuous compliance \n AI-driven innovation is creating a surge in regulations, resulting in over 200 daily updates across more than 900 regulatory agencies 4 , as highlighted in our research. Compliance has become increasingly difficult, with organizations struggling to avoid fines and comply with varying requirements across regions. \n To navigate these challenges effectively, security leaders’ responsibilities are expanding to include oversight across governance and compliance, including oversight of traditional data catalog and governance solutions led by the central data office. Leaders also cite the need for regulation and audit readiness. \n Microsoft Purview enables compliance and governance by: \n \n Streamlining compliance with Microsoft Purview Compliance Manager templates, step-by-step guidance, and insights for region and industry-specific regulations, including GDPR, HIPAA, and AI-specific regulation like the EU AI Act. \n Supporting legal matters such as forensic and internal investigations with audit trail records in Microsoft Purview eDiscovery and Audit. \n Activating and governing data for trustworthy analytics and AI with Microsoft Purview Unified Catalog, which enables visibility across your data estate and data confidence via data quality, data lineage, and curation capabilities for federated governance. \n \n Microsoft Purview’s suite of capabilities provides visibility and accountability, enabling security leaders to meet stringent compliance demands while advancing AI initiatives with confidence. \n Organizations need a unified approach to secure and govern data \n Organizations are calling for an integrated platform to address data security, governance, and compliance collectively. Our research shows that 95% of leaders agree that unifying teams and tools is a top priority 5 and 90% plan to adopt a unified solution to mitigate data related risks and maximize impact 6 . \n Integration isn't just about convenience, it’s about enabling innovation with trusted data protection. Microsoft Purview enables a shared responsibility model, allowing individual business units to own their data while giving central teams oversight and policy control. \n As organizations adopt a unified platform approach, our findings reveal the upside potential not only being reduced risk but also cost savings. With AI-powered copilots such as Security Copilot in Microsoft Purview, data protection tasks are simplified with natural-language guidance, especially for under resourced teams. \n Accelerating AI transformation with Microsoft Purview \n Microsoft Purview helps security, compliance, and governance teams navigate the complexities of AI innovation while implementing effective data protection and governance strategies. \n Microsoft partner EY highlights the results they are seeing: \n \n “We are seeing 25%–30% time savings when we build secure features using [Microsoft] Purview SDK. What was once fragmented is now centralized. With [Microsoft] Purview, everything comes together on one platform, giving a unified foundation to innovate and move forward with confidence.” \n – Prashant Garg, Partner of Data and AI, EY \n \n We invite you to explore how you can propel your organization toward a more secure future by reading the full research paper at https://aka.ms/SecureAndGovernPaper. Visit our website to learn more about Microsoft Purview. \n \n 1 Forbes, Only 9% Of Surveyed Companies Are Ready To Manage Risks Posed By AI, 2023 2 SAP LeanIX, AI Survey Results, 2024 3 Microsoft, Data Security Index Report, 2024 4 Forbes, Cost of Compliance, Thomson Reuters, 2021 5 Microsoft, Audience Research, 2024 6 Microsoft, Customer Requirements Research, 2024 ","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})@stringLength":"7269","kudosSumWeight":1,"repliesCount":0,"readOnly":false,"images":{"__typename":"AssociatedImageConnection","edges":[{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE2NzU5LTQ4NVhDZA?revision=12\"}"}}],"totalCount":1,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"videos":{"__typename":"VideoConnection","edges":[],"totalCount":0,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"coverImage":{"__typename":"UploadedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE2NzU5LTQ4NVhDZA?revision=12"},"coverImageProperties":{"__typename":"CoverImageProperties","style":"STANDARD","titlePosition":"BOTTOM","altText":""}},"Conversation:conversation:4414757":{"__typename":"Conversation","id":"conversation:4414757","topic":{"__typename":"BlogTopicMessage","uid":4414757},"lastPostingActivityTime":"2025-05-21T11:12:29.270-07:00","solved":false},"User:user:2087995":{"__typename":"User","uid":2087995,"login":"LouAdesida","registrationData":{"__typename":"RegistrationData","status":null},"deleted":false,"avatar":{"__typename":"UserAvatar","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/dS0yMDg3OTk1LUM5R0RCUQ?image-coordinates=114%2C251%2C992%2C1129"},"id":"user:2087995"},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUZ6czdneQ?revision=11\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUZ6czdneQ?revision=11","title":"announcements ms build 15.png","associationType":"COVER","width":1920,"height":1009,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LVkyeUVVQQ?revision=11\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LVkyeUVVQQ?revision=11","title":"clipboard_image-12-1747427828494.png","associationType":"BODY","width":1785,"height":1684,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUI1RExSNg?revision=11\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUI1RExSNg?revision=11","title":"clipboard_image-2-1747427504999.png","associationType":"BODY","width":975,"height":548,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LU9FdVVEUA?revision=11\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LU9FdVVEUA?revision=11","title":"clipboard_image-3-1747427505007.png","associationType":"BODY","width":1600,"height":898,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LXloMzBKMw?revision=11\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LXloMzBKMw?revision=11","title":"clipboard_image-4-1747427505005.png","associationType":"BODY","width":1432,"height":801,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LVlhNmEycw?revision=11\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LVlhNmEycw?revision=11","title":"clipboard_image-5-1747427505004.png","associationType":"BODY","width":1428,"height":799,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LXhZMzJLVw?revision=11\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LXhZMzJLVw?revision=11","title":"clipboard_image-6-1747427505004.png","associationType":"BODY","width":1432,"height":747,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LVg0aHRldw?revision=11\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LVg0aHRldw?revision=11","title":"clipboard_image-7-1747427505002.jpeg","associationType":"BODY","width":1364,"height":965,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LVQyYk5KSw?revision=11\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LVQyYk5KSw?revision=11","title":"clipboard_image-8-1747427505006.png","associationType":"BODY","width":1431,"height":809,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUJuV0lNZw?revision=11\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUJuV0lNZw?revision=11","title":"clipboard_image-9-1747427505001.png","associationType":"BODY","width":850,"height":461,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUZhZlNJYg?revision=11\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUZhZlNJYg?revision=11","title":"clipboard_image-10-1747427505003.png","associationType":"BODY","width":1429,"height":804,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUlRQnRHSQ?revision=11\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUlRQnRHSQ?revision=11","title":"clipboard_image-11-1747427505002.png","associationType":"BODY","width":1429,"height":852,"altText":""},"BlogTopicMessage:message:4414757":{"__typename":"BlogTopicMessage","subject":"Enterprise-grade controls for AI apps and agents built with Azure AI Foundry and Copilot Studio","conversation":{"__ref":"Conversation:conversation:4414757"},"id":"message:4414757","revisionNum":11,"uid":4414757,"depth":0,"board":{"__ref":"Blog:board:microsoft-security-blog"},"author":{"__ref":"User:user:2087995"},"teaser@stripHtml({\"removeProcessingText\":true,\"truncateLength\":-1})":"","introduction":"","metrics":{"__typename":"MessageMetrics","views":6510},"postTime":"2025-05-19T09:23:41.328-07:00","lastPublishTime":"2025-05-21T11:12:29.270-07:00","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})":" AI innovation is moving faster than ever, and more AI projects are moving beyond experimentation into deployment, to drive tangible business impact. As organizations accelerate innovation with custom AI applications and agents, new risks emerge across the software development lifecycle and AI stack related to data oversharing and leaks, new vulnerabilities and threats, and non-compliance with stringent regulatory requirements \n Through 2025, poisoning of software supply chains and infrastructure technology stacks will constitute more than 70% of malicious attacks against AI used in the enterprise 1 , highlighting potential threats that originate early in development. Today, the average cost of a data breach is $4.88 million, but when security issues are caught early in the development process, that number drops dramatically to just $80 per incident 2 . \n The message is very clear; security can’t be an afterthought anymore. It must be a team sport across the organization, embedded from the start and throughout the development lifecycle. That's why developers and security teams should align on processes and tools that bring security into every stage of the AI development lifecycle and give security practitioners visibility into and the ability to mitigate risks. \n To address these growing challenges and help customers secure and govern their AI workloads across development and security teams, we are: \n \n Enabling Azure AI Foundry and Microsoft Copilot Studio to provide best-in-class foundational capabilities to secure and govern AI workloads \n \n \n Deeply integrating and embedding industry-leading capabilities from Microsoft Purview, Microsoft Defender, and Microsoft Entra into Azure AI Foundry and Microsoft Copilot Studio \n \n This week, 3,000 developers are gathering in Seattle for the annual Microsoft Build conference, with many more tuning in online, to learn practical skills for accelerating their AI apps and agents' innovation. To support their AI innovation journey, today we are excited to announce several new capabilities to help developers and organizations secure and govern AI apps and agents. \n New Azure AI Foundry foundational capabilities to secure and govern AI workloads \n Azure AI Foundry enhancements for AI security and safety \n With 70,000 customers, 100 trillion tokens processed this quarter, and 2 billion enterprise search queries each day, Azure AI Foundry has grown beyond just an application layer—it's now a comprehensive platform for building agents that can plan, take action, and continuously learn to drive real business outcomes. \n To help organizations build and deploy AI with confidence, we’re introducing new security and safety capabilities and insights for developers in Azure AI Foundry \n Introducing Spotlighting to detect and block prompt injection attacks in real time \n As AI systems increasingly rely on external data sources, a new class of threats has emerged. Indirect prompt injection attacks embed hidden instructions in documents, emails, and web content, tricking models into taking unauthorized actions without any direct user input. These attacks are difficult to detect and hard to prevent using traditional filters alone. \n To address this, Azure AI Content Safety is introducing Spotlighting, now available in preview. Spotlighting strengthens the Prompt Shields guardrail by improving its ability to detect and handle potential indirect prompt injections, where hidden adversarial instructions are embedded in external content. This new capability helps prevent the model from inadvertently acting on malicious prompts that are not directly visible to the user. \n Enable Spotlighting in Azure AI Content Safety to detect potential indirect prompt injection attacks\n \n New capabilities for task adherence evaluation and task adherence mitigation to ensure agents remain within scope \n As developers build more capable agents, organizations face growing pressure to help confirm those agents act within defined instructions and policy boundaries. Even small deviations can lead to tool misuse, broken workflows, or risks like unintended exposure of sensitive data. To solve this, Azure AI Foundry now includes task adherence for agents, now in preview and powered by two components: a real-time evaluation and a new control within Azure AI Content Safety. \n At the core is a real-time task adherence evaluation API, part of Azure AI Content Safety. This API assesses whether an agent’s behavior is aligned with its assigned task by analyzing the user’s query, system instructions, planned tool calls, and the agent’s response. The evaluation framework is built on Microsoft’s Agent Evaluators, which measure intent resolution, tool selection accuracy, completeness of response, and overall alignment to the original request. Developers can run this scoring logic locally using the Task Adherence Evaluator in the Azure AI Evaluation SDK, with a five-point scale that ranges from fully nonadherent to fully adherent. This gives teams a flexible and transparent way to inspect task-level behavior before it causes downstream issues. \n Task adherence is enforced through a new control in Azure AI Content Safety. If an agent goes off-task, the control can block tool use, pause execution, or trigger human review. In Azure AI Agent Service, it is available as an opt-in feature and runs automatically. Combined with real-time evaluation, this control helps to ensure that agents stay on task, follow instructions, and operate according to enterprise policies. \n Learn more about Prompt Shields in Azure AI Content Safety. \n \n Azure AI Foundry continuous evaluation and monitoring of agentic systems \n Maintaining high performance and compliance for AI agents after deployment is a growing challenge. Without ongoing oversight, issues like performance degradation, safety risks, or unintentional misuse of resources can slip through unnoticed. \n To address this, Azure AI Foundry introduces continuous evaluation and monitoring of agentic systems, now in preview, provides a single pane of glass dashboard to track key metrics such as performance, quality, safety, and resource usage in real time. Continuous evaluation runs quality and safety evaluations at a sampled rate of production usage with results made available in the Azure AI Foundry Monitoring dashboard and published to Application Insights. Developers can set alerts to detect drift or regressions and use Azure Monitor to gain full-stack visibility into their AI systems. \n For example, an organization using an AI agent to assist with customer-facing tasks can monitor groundedness and detect a decline in quality when the agent begins referencing irrelevant information, helping teams to act before it potentially negatively affects trust of users. \n \n Azure AI Foundry evaluation integrations with Microsoft Purview Compliance Manager, Credo AI, and Saidot for streamlined compliance \n AI regulations and standards introduce new requirements for transparency, documentation, and risk management for high-risk AI systems. As developers build AI applications and agents, they may need guidance and tools to help them evaluate risks based on these requirements and seamlessly share control and evaluation insights with compliance and risk teams. \n Today, we are announcing previews for Azure AI Foundry evaluation tool’s integration with a compliance management solution, Microsoft Purview Compliance Manager, and AI governance solutions, Credo AI and Saidot. These integrations help define risk parameters, run suggested compliance evaluations, and collect evidence for control testing and auditing. \n For example, for a developer who’s building an AI agent in Europe may be required by their compliance team to complete a Data Protection Impact Assets (DPIA) and Algorithmic Impact Assessment (AIA) to meet internal risk management and technical documentation requirements aligned with emerging AI governance standards and best practices. Based on Purview Compliance Manager’s step-by-step guidance on controls implementation and testing, the compliance teams can evaluate risks such as potential bias, cybersecurity vulnerabilities, or lack of transparency in model behavior. \n Once the evaluation is conducted in Azure AI Foundry, the developer can obtain a report with documented risk, mitigation, and residual risk for compliance teams to upload to Compliance Manager to support audits and provide evidence to regulators or external stakeholders. \n \n Assess controls for Azure AI Foundry against emerging AI governance standards\n Learn more about Purview Compliance Manager. \n Learn more about the integration with Credo AI and Saidot in this blogpost. \n \n Leading Microsoft Entra, Defender and Purview value extended to Azure AI Foundry and Microsoft Copilot Studio \n Introducing Microsoft Entra Agent ID to help address agent sprawl and manage agent identity \n Organizations are rapidly building their own AI agents, leading to agent sprawl and a lack of centralized visibility and management. Security teams often struggle to keep up, unable to see which agents exist and whether they introduce security or compliance risks. Without proper oversight, agent sprawl increases the attack surface and makes it harder to manage these non-human identities. \n To address this challenge, we’re announcing the public preview of Microsoft Entra Agent ID, a new capability in the Microsoft Entra admin center that gives security admins visibility and control over AI agents built with Copilot Studio and Azure AI Foundry. With Microsoft Entra Agent ID, an agent created through Copilot Studio or Azure AI Foundry is automatically assigned an identity with no additional work required from the developers building them. This is the first step in a broader initiative to manage and protect non-human identities as organizations continue to build AI agents. \n \n : Security and identity admins can gain visibility into AI agents built in Copilot Studio and Azure AI Foundry in the Microsoft Entra Admin Center\n This new capability lays the foundation for more advanced capabilities coming soon to Microsoft Entra. \n We also know that no one can do it alone. Security has always been a team sport, and that’s especially true as we enter this new era of protecting AI agents and their identities. We’re energized by the momentum across the industry; two weeks ago, we announced support for the Agent-to-Agent (A2A) protocol and began collaborating with partners to shape the future of AI identity workflows. \n Today, we’re also excited to announce new partnerships with ServiceNow and Workday. As part of this, we’ll integrate Microsoft Entra Agent ID with the ServiceNow AI Platform and the Workday Agent System of Record. This will allow for automated provisioning of identities for future digital employees. \n Learn more about Microsoft Entra Agent ID. \n Microsoft Defender security alerts and recommendations now available in Azure AI Foundry \n As more AI applications are deployed to production, organizations need to predict and prevent potential AI threats with natively integrated security controls backed by industry-leading Gen AI and threat intelligence for AI deployments. Developers need critical signals from security teams to effectively mitigate security risks related to their AI deployments. When these critical signals live in separate systems outside the developer experience, this can create delays in mitigation, leaving opportunities for AI apps and agents to become liabilities and exposing organizations to various threats and compliance violations. \n Now in preview, Microsoft Defender for Cloud integrates AI security posture management recommendations and runtime threat protection alerts directly into the Azure AI Foundry portal. These capabilities, previously announced as part of the broader Microsoft Defender for Cloud solution, are extended natively into Azure AI Foundry enabling developers to access alerts and recommendations without leaving their workflows. This provides real-time visibility into security risks, misconfigurations, and active threats targeting their AI applications on specific Azure AI projects, without needing to switch tools or wait on security teams to provide details. \n Security insights from Microsoft Defender for Cloud help developers identify and respond to threats like jailbreak attacks, sensitive data leakage, and misuse of system resources. These insights include: \n \n AI security posture recommendations that identify misconfigurations and vulnerabilities in AI services and provide best practices to reduce risk \n \n \n Threat protection alerts for AI services that notify developers of active threats and provide guidance for mitigation, across more than 15 detection types \n \n For example, a developer building an AI-powered agent can receive security recommendations suggesting the use of Azure Private Link for Azure AI Services resources. This reduces the risk of data leakage by handling the connectivity between consumers and services over the Azure backbone network. Each recommendation includes actionable remediation steps, helping teams identify and mitigate risks in both pre- and post-deployment phases. This helps to reduce risks without slowing down innovation. \n \n : Developers can view security alerts on the Risks + alerts page in Azure AI Foundry\n \n : Developers can view recommendations on the Guardrails + controls page in Azure AI Foundry\n This integration is currently in preview and will be generally available in June 2025 in Azure AI Foundry. Learn more about protecting AI services with Microsoft Defender for Cloud. \n Microsoft Purview capabilities extended to secure and govern data in custom-built AI apps and agents \n Data oversharing and leakage are among the top concerns for AI adoption, and central to many regulatory requirements. For organizations to confidently deploy AI applications and agents, both low code and pro code developers need a seamless way to embed security and compliance controls into their AI creations. Without simple, developer-friendly solutions, security gaps can quickly become blockers, delaying deployment and increasing risks as applications move from development to production. \n Today, Purview is extending its enterprise-grade data security and compliance capabilities, making it easier for both low code and pro code developers to integrate data security and compliance into their AI applications and agents, regardless of which tools or platforms they use. \n For example, with this update, Microsoft Purview DSPM for AI becomes the one place data security teams can see all the data risk insights across Microsoft Copilots, agents built in Agent Builder and Copilot Studio, and custom AI apps and agents built in Azure AI Foundry and other platforms. Admins can easily drill into security and compliance insights for specific AI apps or agents, making it easier to investigate and take action on potential risks. \n \n : Data security admins can now find data security and compliance insights across Microsoft Copilots, agents built with Agent Builder and Copilot Studio, and custom AI apps and agents in Microsoft Purview DSPM for AI\n \n In the following sections, we will provide more details about the updates to Purview capabilities in various AI workloads. \n 1. Microsoft Purview data security and compliance controls can be extended to any custom-built AI application and agent via the new Purview SDK or the native Purview integration with Azure AI Foundry. \n The new capabilities make it easy and effortless for security teams to bring the same enterprise-grade data security compliance controls available today for Microsoft 365 Copilot to custom AI applications and agents, so organizations can: \n \n Discover data security risks, such as sensitive data in user prompts, and data compliance risks, such as harmful content, and get recommended actions to mitigate risks proactively in Microsoft Purview Data Security Posture Management (DSPM) for AI. \n \n \n Protect sensitive data against data leakage and insider risks with Microsoft Purview data security policies. \n \n \n Govern AI interactions with Audit, Data Lifecycle Management, eDiscovery, and Communication Compliance. \n \n Microsoft Purview SDK \n Microsoft Purview now offers Purview SDK, a set of REST APIs, documentation, and code samples, currently in preview, enabling developers to integrate Purview's data security and compliance capabilities into AI applications or agents within any integrated development environment (IDE). \n \n : By embedding Purview APIs into the IDE, developers help enable their AI apps to be secured and governed at runtime\n For example, a developer building an AI agent using an AWS model can use the Purview SDK to enable their AI app to automatically identify and block sensitive data entered by users before it’s exposed to the model, while also providing security teams with valuable signals that support compliance. \n With Purview SDK, startups, ISVs, and partners can now embed Purview industry-leading capabilities directly into their AI software solutions, making these solutions Purview aware and easier for their customers to secure and govern data in their AI solutions. For example, Infosys Vice President and Delivery Head of Cyber Security Practice, Ashish Adhvaryu indicates, “Infosys Cyber Next platform integrates Microsoft Purview to provide enhanced AI security capabilities. Our solution, the Cyber Next AI assistant (Cyber Advisor) for the SOC analyst, leverages Purview SDK to drive proactive threat mitigation with real-time monitoring and auditing capabilities. This integration provides holistic AI-assisted protection, enhancing cybersecurity posture.\" \n Microsoft partner EY (previously known as Ernst and Young) has also leveraged the new Purview SDK to embed Purview value into their GenAI initiatives. “We’re not just building AI tools, we are creating Agentic solutions where trust, security, and transparency are present from the start, supported by the policy controls provided through the Purview SDK. We’re seeing 25 to 30 percent time savings when we build secure features using the Purview SDK,” noted Sumanta Kar, Partner, Innovation and Emerging Tech at EY. \n Learn more about the Purview SDK. \n \n Microsoft Purview integrates natively with Azure AI Foundry \n Organizations are developing an average of 14 custom AI applications. The rapid pace of AI innovation may leave security teams unaware of potential data security and compliance risks within their environments. \n With the update announced today, Azure AI Foundry signals are now directly integrated with Purview Data Security Posture Management for AI, Insider Risk Management, and data compliance controls, minimizing the need for additional development work. \n For example, for AI applications and agents built with Azure AI Foundry models, data security teams can gain visibility into AI usage and data risks in Purview DSPM for AI, with no additional work from developers. Data security teams can also detect, investigate, and respond to both malicious and inadvertent user activities, such as a departing employee leveraging an AI agent to retrieve an anomalous amount of sensitive data, with Microsoft Purview Insider Risk Management (IRM) policies. Lastly, user prompts and AI responses in Azure AI apps and agents can now be ingested into Purview compliance tools as mentioned above. \n Learn more about Microsoft Purview for Azure AI Foundry. \n \n 2. Purview data protections extended to Copilot Studio agents grounded in Microsoft Dataverse data \n Coming to preview in June, Purview Information Protection extends auto-labeling and label inheritance coverage to Dataverse to help prevent oversharing and data leaks. Information Protection makes it easier for organizations to automatically classify and protect sensitive data at scale. A common challenge is that sensitive data often lands in Dataverse from various sources without consistent labeling or protection. The rapid adoption of agents built using Copilot Studio and grounding data from Dataverse increases the risk of data oversharing and leakage if data is not properly protected. \n With auto-labeling, data stored in Dataverse tables can be automatically labeled based on policies set in Microsoft Purview, regardless of its source. This reduces the need for manual labeling effort and protects sensitive information from the moment it enters Dataverse. \n With label inheritance, AI agent responses grounded in Dataverse data will automatically carry and honor the source data’s sensitivity label. If a response pulls from multiple tables with different labels, the most restrictive label is applied to ensure consistent protection. \n For example, a financial advisor building an agent in Copilot Studio might connect multiple Dataverse tables, some labeled as “General” and others as “Highly Confidential.” If a response pulls from both, it will inherit the most restrictive label, in this case, \"Highly Confidential,” to prevent unauthorized access and ensure appropriate protections are applied across both maker and users of the agent. \n Together, auto-labeling and label inheritance in Dataverse support a more secure, automated foundation for AI. \n \n : Sensitivity labels will be automatically applied to data in Dataverse\n \n : AI-generated responses will inherit and honor the source data’s sensitivity labels\n Learn more about protecting Dataverse data with Microsoft Purview. \n \n 3. Purview DSPM for AI can now provide visibility into unauthenticated interactions with Copilot Studio agents \n As organizations increasingly use Microsoft Copilot Studio to deploy AI agents for frontline customer interactions, gaining visibility into unauthenticated user interactions and proactively mitigating risks becomes increasingly critical. \n Building on existing Purview and Copilot Studio integrations, we’ve extended DSPM for AI and Audit in Copilot Studio to provide visibility into unauthenticated interactions, now in preview. This gives organizations a more comprehensive view of AI-related data security risks across authenticated and unauthenticated users. \n For example, a healthcare provider hosting an external, customer-facing agent assistant must be able to detect and respond to attempts by unauthenticated users to access sensitive patient data. With these new capabilities in DSPM for AI, data security teams can now identify these interactions, assess potential exposure of sensitive data, and act accordingly. Additionally, integration with Purview Audit provides teams with seamless access to information needed for audit requirements. \n \n : Gain visibility into all AI interactions, including those from unauthenticated users\n Learn more about Purview for Copilot Studio. \n \n 4. Purview Data Loss Prevention extended to more Microsoft 365 agent scenarios \n To help organizations prevent data oversharing through AI, at Ignite 2024, we announced that data security admins could prevent Microsoft 365 Copilot from using certain labeled documents as grounding data to generate summaries or responses. \n Now in preview, this control also extends to agents published in Microsoft 365 Copilot that are grounded by Microsoft 365 data, including pre-built Microsoft 365 agents, agents built with the Agent Builder, and agents built with Copilot Studio. This helps ensure that files containing sensitive content are used appropriately by AI agents. \n For example, confidential legal documents with highly specific language that could lead to improper guidance if summarized by an AI agent, or \"Internal only” documents that shouldn’t be used to generate content that can be shared outside of the organization. \n \n : Extend data loss prevention (DLP) policies to Microsoft 365 Copilot agents to protect sensitive data\n Learn more about Data Loss Prevention for Microsoft 365 Copilot and agents. \n The data protection capabilities we are extending to agents in Agent Builder and Copilot Studio demonstrate our continued investment in strengthening the Security and Governance pillar of the Copilot Control System (CSS). CCS provides integrated controls to help IT and security teams secure, manage, and monitor Copilot and agents across Microsoft 365, spanning governance, management, and reporting. \n Learn more here. \n \n Explore additional resources \n As developers and security teams continue to secure AI throughout its lifecycle, it’s important to stay ahead of emerging risks and ensure protection. Microsoft Security provides a range of tools and resources to help you proactively secure AI models, apps, and agents from code to runtime. Explore the following resources to deepen your understanding and strengthen your approach to AI security: \n \n Learn more about Security for AI solutions on our webpage  \n \n \n Learn more about Microsoft Purview SDK \n \n \n Get started with Azure AI Foundry \n \n \n Get started with Microsoft Entra \n \n \n Get started with Microsoft Purview  \n \n \n Get started with Microsoft Defender for Cloud  \n \n \n Get started with Microsoft 365 Copilot \n \n \n Get started with Copilot Studio \n \n \n Sign up for a free Microsoft 365 E5 Security Trial and Microsoft Purview Trial  \n \n \n 1 Predicts 2025: Navigating Imminent AI Turbulence for Cybersecurity, Jeremy D'Hoinne, Akif Khan, Manuel Acosta, Avivah Litan, Deepak Seth, Bart Willemsen, 10 February 2025 \n 2 IBM. \"Cost of a Data Breach 2024: Financial Industry.\" IBM Think, 13 Aug. 2024, https://www.ibm.com/think/insights/cost-of-a-data-breach-2024-financial-industry; Cser, Tamas. \"The Cost of Finding Bugs Later in the SDLC.\" Functionize, 5 Jan. 2023, https://www.functionize.com/blog/the-cost-of-finding-bugs-later-in-the-sdlc \n ","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})@stringLength":"26533","kudosSumWeight":1,"repliesCount":0,"readOnly":false,"images":{"__typename":"AssociatedImageConnection","edges":[{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUZ6czdneQ?revision=11\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDI","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LVkyeUVVQQ?revision=11\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDM","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUI1RExSNg?revision=11\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDQ","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LU9FdVVEUA?revision=11\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDU","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LXloMzBKMw?revision=11\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDY","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LVlhNmEycw?revision=11\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDc","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LXhZMzJLVw?revision=11\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDg","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LVg0aHRldw?revision=11\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDk","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LVQyYk5KSw?revision=11\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDEw","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUJuV0lNZw?revision=11\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDEx","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUZhZlNJYg?revision=11\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDEy","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUlRQnRHSQ?revision=11\"}"}}],"totalCount":12,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"videos":{"__typename":"VideoConnection","edges":[],"totalCount":0,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"coverImage":{"__typename":"UploadedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDE0NzU3LUZ6czdneQ?revision=11"},"coverImageProperties":{"__typename":"CoverImageProperties","style":"STANDARD","titlePosition":"BOTTOM","altText":""}},"Conversation:conversation:4405550":{"__typename":"Conversation","id":"conversation:4405550","topic":{"__typename":"BlogTopicMessage","uid":4405550},"lastPostingActivityTime":"2025-05-15T12:52:49.267-07:00","solved":false},"User:user:222395":{"__typename":"User","uid":222395,"login":"LizTesch","registrationData":{"__typename":"RegistrationData","status":null},"deleted":false,"avatar":{"__typename":"UserAvatar","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/dS0yMjIzOTUtekVYcEVj?image-coordinates=246%2C26%2C777%2C558"},"id":"user:222395"},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDA1NTUwLVVJenJuaQ?revision=14\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDA1NTUwLVVJenJuaQ?revision=14","title":"Test596.jpg","associationType":"COVER","width":1486,"height":602,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDA1NTUwLVR5Q1owbw?revision=14\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDA1NTUwLVR5Q1owbw?revision=14","title":"image.png","associationType":"BODY","width":997,"height":636,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDA1NTUwLUszeUh3Tw?revision=14\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDA1NTUwLUszeUh3Tw?revision=14","title":"image.png","associationType":"BODY","width":889,"height":340,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDA1NTUwLUJWeUJ3Rw?revision=14\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDA1NTUwLUJWeUJ3Rw?revision=14","title":"SCAgents90.jpg","associationType":"BODY","width":1362,"height":606,"altText":""},"BlogTopicMessage:message:4405550":{"__typename":"BlogTopicMessage","subject":"Blog Series: Charting Your Path to Cyber Resiliency","conversation":{"__ref":"Conversation:conversation:4405550"},"id":"message:4405550","revisionNum":14,"uid":4405550,"depth":0,"board":{"__ref":"Blog:board:microsoft-security-blog"},"author":{"__ref":"User:user:222395"},"teaser@stripHtml({\"removeProcessingText\":true,\"truncateLength\":-1})":"","introduction":"Part 3: Use Security Copilot to Increase Your Organization’s Cyber Resiliency ","metrics":{"__typename":"MessageMetrics","views":519},"postTime":"2025-04-21T08:00:00.032-07:00","lastPublishTime":"2025-05-15T12:52:49.267-07:00","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})":" \"Cyber resilience is more than just a buzzword in the security industry; it is an essential approach to safeguarding digital assets in an era where cyber threats are not a matter of ‘if’ but ‘when’.\" \n - World Economic Forum, 2024 \n \n Cyber resiliency describes an organization’s ability to anticipate, withstand, respond and recover from adverse conditions caused by cyberattacks. Destructive cyberattacks such as ransomware can be highly impactful to business operations and profitability. With its emphasis on protecting our companies’ most critical business functions, cyber resiliency enhances the reputation of the Cybersecurity function - it can even help us achieve that most elusive goal of demonstrating our value to the business. \n In Part 1 and Part 2 of this series we examined the origins of cyber resiliency and Microsoft’s approach to helping our clients become more cyber resilient. As we learned in Part 1, Microsoft has identified 24 key issues that organizations should strategically target to enhance their cyber resilience. \n These key issues are grouped into the following categories: \n \n Low maturity security operations \n Insecure configuration of identity provider \n Insufficient privilege access and lateral movement controls \n No Multi-factor Authentication \n Lack of information protection control \n Limited adoption of modern security frameworks \n \n Let’s look at how Security Copilot can help, starting with the issue of Low maturity security operations. \n Security Operations \n Since its official release in April 2024, we’ve seen many Microsoft clients benefit from Security Copilot’s capabilities to address cyber resiliency issues in the category of Low maturity SOC Operations. For example, through its built-in integration with the Microsoft Defender XDR suite, Security Copilot features such as incident summaries, KQL Query Assistant and guided response can help with these components of the control: \n \n Skill gaps across security operations \n Limited use of endpoint detection and response \n Gaps in security monitoring and integration \n \n Even customers choosing not to use the full Defender XDR suite also benefit from Copilot’s abilities to help them reverse engineer malware and generate scripts. And organizations with limited or no SIEM/SOAR capabilities can also take advantage of Security Copilot’s easy integration with Microsoft Sentinel to accelerate SIEM/SOAR adoption. \n Security Copilot also assists with the issue of Ineffective SOC processes and operating model in 2 key ways: Reporting and Threat Intelligence. \n Reporting \n Security Copilot customers love the tool’s ability to quickly generate comprehensive incident reports geared to a variety of audiences, both technical and executive. \n Microsoft Defender for Threat Intelligence Integration \n Cyber Threat Intelligence (CTI) plays an important role in cyber resilience. NIST notes that an organization’s cyber resiliency decreases as the threat environment changes and new threat actors, techniques and vulnerabilities are introduced. Yet we often see customers not using threat intelligence effectively or worse, not using it at all. Within the M365 Portal, the embedded Security Copilot experience features incident summaries that are automatically enriched with threat intelligence from the full version of Microsoft Defender for Threat Intelligence. \n In both the embedded and standalone experiences, Security Copilot enables SOC analysts to use natural language to learn more about the threats and threat actors affecting their company and industry, get information about specific IOCs, and perform vulnerability impact assessments. Not sure how to start using threat intelligence? That’s OK, Security Copilot’s got you covered with suggested prompts like these in the standalone portal: \n \n Keep in mind, though, that Security Copilot is not just for SOC Operations– in fact, one of the key mistakes we’ve seen customers make in Security Copilot proof-of-concepts has been in failing to involve Security teams outside the SOC. Simply put, if your organization is just using Security Copilot in the SOC, you’re significantly limiting its impact on your overall cyber resilience. So let’s look next at what else it can do through integrations with identity management, data protection, and cloud platforms. \n Identity Management \n According to the Verizon Data Breach Investigations Report (DBIR), most breaches start with stolen credentials. This is reflected in Microsoft’s cyber resilience guidance where 3 of the key issue categories are identity-based. Security Copilot aids with identifying gaps in Entra configuration, both in the Entra Admin center and the Security Copilot standalone experience. Core capabilities include: \n \n Troubleshooting a user’s sign-in failures \n Providing user account details and authentication methods \n Exploring audit log events for a particular user, group, or application \n Enumerating Entra ID roles and group memberships \n \n In this case I’m troubleshooting a recent failed sign on attempt by a user. Security Copilot gives me the details of the sign-in and tells me in plain language the reason for the failure, along with the applicable conditional access policy, and the remediation steps to take: \n \n Security and Identity pros whose organizations already use Microsoft’s Workload Identities feature can also take advantage of Security Copilot’s abilities to investigate risky Entra ID applications. Security Copilot’s reach even extends to protection of Active Directory on-premises through its integration with Microsoft's Unified Security Operations Platform, which can include Defender for Identity alerts, as well as Windows Security Events collected by Microsoft Sentinel. \n Data Protection and Vulnerability Management \n The cyber resilience category Lack of Information Control covers a diverse set of components, including ineffective data loss prevention controls and lack of patch and vulnerability management. Security Copilot integrations support various teams across the organization in areas such as: \n Data Protection \n Security Copilot has a powerful integration with Microsoft Purview Data Security Posture Management (DSPM), a centralized data security management tool that includes signals from Microsoft Purview Information Protection, Data Loss Prevention, and Insider Risk Management. Just some of the many goals of this integration are: \n \n Helping Security teams conduct deeper investigations into data security incidents \n Enabling DLP admins to better identify gaps in DLP policy coverage \n Identifying devices involved in data exfiltration activities \n Assisting with insider risk management investigations \n \n Vulnerability Management \n As SANS notes, “The quantity of outstanding vulnerabilities for most large organizations is overwhelming, and all organizations struggle to keep up with the never-ending onslaught of new vulnerabilities in their infrastructure and applications.” Security Copilot works with Microsoft Defender External Attack Surface Management (Defender EASM) to help address this challenge. \n Defender EASM helps identify public-facing assets such as domains and hosts to map your organization’s external attack surface, discover unknown issues, and minimize risk. Security Copilot’s integration with EASM helps teams identify public-facing assets with high-priority CVEs and CVSS scores and find issues like expired domains, expired SSL certificates and SHA1 certificates. If you’re not currently using Defender EASM, it offers a free 30-day trial. (In fact, many customers have been so impressed with EASM and its Security Copilot integration during their trials, they’ve gone ahead and made it a permanent part of their cyber resilience strategy). \n Finally, note that both Purview DSPM and Defender EASM have multi-cloud capabilities. When used in combination with Security Copilot, they can greatly assist IT and Security teams with limited security experience in more than 1 cloud. \n Cloud Platforms \n Finally, in the cyber resilience category Limited adoption of modern security frameworks, Security Copilot helps address the issue of insecure design and configuration across cloud platforms via integrations with Azure Firewall and Azure WAF. \n Security Copilot features include identifying malicious traffic, searching for a given IDPS signature across all Azure Firewalls in the environment, and generating recommendations to improve the overall security of your deployments. Security Copilot can also help analyze Azure Web Application Firewall (WAF) logs to provide context for: \n \n Most frequently triggered rules \n Malicious IP addresses identified \n Blocked SQL injection (SQLi) and Cross-site Scripting (XSS) requests \n \n Microsoft Copilot for Security integration is available for both Azure WAF on both Azure Application Gateway and Azure WAF on Azure Front Door. \n Conclusion \n As we've seen throughout this series, Microsoft provides practical and tactical guidance to help our customers enhance their cyber resiliency to sophisticated and destructive cyberattacks that impact critical business operations. Security Copilot offers new capabilities to help build cyber resiliency in diverse and challenging areas such as: \n \n Vulnerability management \n Data security \n Multi-cloud management \n Security operations \n Identity protection \n \n In Building Secure, Resilient Architectures for Cyber Mission Assurance, MITRE emphasizes that “game-changing technologies, techniques, and strategies can make transformational improvements in the resilience of our critical systems.” It's clear that Security Copilot is already one of those game-changers and, with the recent announcement of Security Copilot agents, charting your path to cyber resilience just got a lot more exciting. \n ","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})@stringLength":"9879","kudosSumWeight":1,"repliesCount":0,"readOnly":false,"images":{"__typename":"AssociatedImageConnection","edges":[{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDA1NTUwLVVJenJuaQ?revision=14\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDI","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDA1NTUwLVR5Q1owbw?revision=14\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDM","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDA1NTUwLUszeUh3Tw?revision=14\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDQ","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDA1NTUwLUJWeUJ3Rw?revision=14\"}"}}],"totalCount":4,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"videos":{"__typename":"VideoConnection","edges":[],"totalCount":0,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"coverImage":{"__typename":"UploadedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00NDA1NTUwLVVJenJuaQ?revision=14"},"coverImageProperties":{"__typename":"CoverImageProperties","style":"STANDARD","titlePosition":"BOTTOM","altText":""}},"Conversation:conversation:4396041":{"__typename":"Conversation","id":"conversation:4396041","topic":{"__typename":"BlogTopicMessage","uid":4396041},"lastPostingActivityTime":"2025-03-24T09:44:12.556-07:00","solved":false},"User:user:2440949":{"__typename":"User","uid":2440949,"login":"Nathalia_Borges","registrationData":{"__typename":"RegistrationData","status":null},"deleted":false,"avatar":{"__typename":"UserAvatar","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/dS0yNDQwOTQ5LTU3NDYwMGk5MzMzQ0U4MDlEOUNFRjg4"},"id":"user:2440949"},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLVB2M2pqMg?revision=5\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLVB2M2pqMg?revision=5","title":"Agents.png","associationType":"COVER","width":1278,"height":720,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLXRQNlAzdQ?revision=5\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLXRQNlAzdQ?revision=5","title":"clipboard_image-1-1742579820550.png","associationType":"BODY","width":1933,"height":1089,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLUthYmJsbA?revision=5\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLUthYmJsbA?revision=5","title":"clipboard_image-2-1742579820574.png","associationType":"BODY","width":1489,"height":838,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLXd0ZmVXNQ?revision=5\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLXd0ZmVXNQ?revision=5","title":"clipboard_image-3-1742579820620.png","associationType":"BODY","width":1658,"height":930,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLUltUTR3dQ?revision=5\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLUltUTR3dQ?revision=5","title":"clipboard_image-4-1742579820642.png","associationType":"BODY","width":1622,"height":879,"altText":""},"BlogTopicMessage:message:4396041":{"__typename":"BlogTopicMessage","subject":"Announcing Alert Triage Agents in Microsoft Purview, powered by Security Copilot","conversation":{"__ref":"Conversation:conversation:4396041"},"id":"message:4396041","revisionNum":5,"uid":4396041,"depth":0,"board":{"__ref":"Blog:board:microsoft-security-blog"},"author":{"__ref":"User:user:2440949"},"teaser@stripHtml({\"removeProcessingText\":true,\"truncateLength\":-1})":" Powered by Security Copilot, the Alert Triage Agents will help organizations prioritize the most critical risks faster. By triaging alerts based on parameters provided by the organization and fine-tuning the process through feedback provided by the data security teams, the agent will upskill teams, provide faster investigation, and enable more assertive data risk mitigation. ","introduction":"Automate the triage of potential data and user risks to prioritize alerts posing the greatest risk to your organization","metrics":{"__typename":"MessageMetrics","views":3975},"postTime":"2025-03-24T09:00:00.071-07:00","lastPublishTime":"2025-03-24T09:44:12.556-07:00","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})":" In today's digital landscape, securing data has become a critical concern across all industries. Organizations face an average of 66 alerts per day, up from 52 in 2023, with teams able to review only 63% of these alerts. Given the sheer volume of data security alerts, it is no surprise that most organizations struggle to keep up[1]. The challenge of addressing the most important risks, combined with a staggering shortage of 4 million security professionals[2], has made it increasingly difficult for organizations to stay ahead of potential dangers such as data breaches and unauthorized access to sensitive information. This can overwhelm data security teams and allows for potentially serious data risks to slip through the cracks. \n To help customers increase the efficacy of their data security programs, address key alerts, and focus on the most critical data risks, we’re thrilled to announce Alert Triage Agents in Microsoft Purview Data Loss Prevention (DLP) and Insider Risk Management (IRM). \n These autonomous Security Copilot capabilities integrated into Microsoft Purview offer an agent-managed alert queue that identifies the DLP and IRM alerts that pose the greatest risk to your organization and should be prioritized first. Alert Triage Agents analyze the content and potential intent involved in an alert, based on the organization’s chosen parameters and risk tolerance. Additionally, they provide a comprehensive explanation for the logic behind that categorization. \n \n \n (Figure 1: Alert Triage Agent in DLP queue) \n \n Today, most teams still rely on manual triage, static rule-based filtering, and siloed security tools[3], which are often ineffective, create blind spots, and can slow down risk mitigation. These new agents empower data security teams to focus on the most important alerts and concentrate on the critical threats, with a dynamic process that takes inputs from data security admins and can also calibrate triage results to better match the organization’s priorities. \n \n \n (Figure 2: Alert Triage Agent in IRM queue, with prioritization rationale window option) \n Alert Triage Agents in DLP and IRM will leverage the power of Generative AI to provide organizations with the following core benefits: \n \n Enhanced alert management: Significantly improve alert prioritization, ensuring that critical risks are addressed first. This leads to faster response times, as teams can focus on the most pressing issues without being distracted by less urgent alerts. Evaluating sometimes complex alerts on DLP and IRM can be time-consuming and speeding the triage process allows teams to spend more time on the most critical cases. \n Increased team efficiency: Increase the efficacy of your team, regardless of the experience level, by triaging and providing relevant information about the top risks. They complement your teams’ skills and allow your team to efficiently handle more incidents, as the most crucial alerts are already identified. Thereby improving key metrics such as overall response time and percentage of alerts addressed. \n Dynamic responses: The agent will learn from the data security team’s feedback and fine-tune its logic, which can be provided based on parameters in natural language. This feedback loop will autonomously adjust how agents categorize the alerts. \n \n \n \n (Figure 3: Feedback loop for fine-tuning alert prioritization) \n A data security admin will be able to select the relevant policies that the agent will evaluate and set the restrictions for the categorization. For example, the admin can select the IRM policies ‘Data Leaks’ and ‘Data Theft’, then ask the agent to ‘prioritize alerts including intellectual property related to Project Obsidian’. The agent then identifies alerts as ‘Needs attention' or ‘Less urgent’ and provides the rationale behind the logic applied. Additionally, the admin can tailor the agent's responses by changing the alert categorization as needed and offering feedback on the changes in natural language, to which the agent will adapt in a few hours. For example, an admin can move an alert from ‘Needs attention’ to ‘Less urgent’ category, and teach the agent to better evaluate alerts by providing properties the agent should focus less on, such as sensitivity labels, or by indicating that an action is a regular business activity for that group. \n Alert Triage Agents are seamlessly integrated within Purview, allowing customers to easily improve the efficiency of their current trusted workflows. These agents empower data security admins by leveraging the power of Security Copilot, a trusted and reliable platform that adheres to global compliance and privacy standards, and that dynamically learns and adapts to emerging threats with a proven track record[4]. \n Alert Triage Agents in Purview public preview starts rolling out on April 27. To get started, check out the visit the Security Copilot product page for more information. Already using Security Copilot? Make sure you’re signed up for the Security Copilot Customer Connection Program (CCP) to receive the latest updates and try the new features — join today at aka.ms/JoinCCP. \n \n Strengthening data security, compliance and governance with Generative AI \n In addition to Alert Triage Agents, we are announcing the general availability of several Security Copilot embedded capabilities within Microsoft Purview that help customers accelerate and scale investigations and upskill their teams. \n Most organizations struggle with understanding the impact of DLP alerts on data and users and assessing the overall efficacy of their DLP policies. Enhanced hunting prompts allow teams to go deeper into alert summaries, providing a detailed exploration of data and users involved in an incident. Additionally, Security Copilot also guides admins through activity explorer insights, offering a birds-eye view of top activities detected over the past week. Admins can use natural language to apply the correct investigation filters to pinpoint specific activities or data. Moreover, the DLP policy insights skill summarizes the intent, scope, and impact of all or selected DLP policies to provide a summarized view of your DLP policies’ coverage. This skill provides insights such as the DLP policies deployed for each workload, the sensitive information types they aim to detect, and the number of rule matches associated with those policies. With this information, security admins can swiftly identify and address any protection gaps in their DLP program. \n \n \n (Figure 3: DLP policy insights) \n Data security, compliance, and governance teams can also leverage the Knowledge Base Hub in Microsoft Purview to guide their experiences across Microsoft Purview. This skill provides instant answers to questions about the Purview platform using public Microsoft documentation. This experience aims to improve user experience by offering direct answers, reducing the need for multiple tabs and searches. Accessible through the Purview portal, Knowledge Base Copilot addresses queries related to all Purview solutions. \n Stay tuned for more information about the innovative integration of Security Copilot and Microsoft Purview and leverage the power of generative AI to take your organization’s data security to the next level. \n Learn more about the innovations designed to help your organization protect data, defend against cyber threats, and stay compliant. Join Microsoft leaders online at Microsoft Secure on April 9. \n \n Get started \n \n Learn more about Copilot for Security in Purview with Microsoft Documentation. \n If you are a security partner interested in using Microsoft Security Copilot with your solutions, sign up to join the Security Copilot Partner Ecosystem. \n Stay up to date on Microsoft Purview features through the Microsoft 365 Roadmap for Microsoft Purview. \n Learn more about these solutions in the Microsoft Purview compliance portal. Visit your Microsoft Purview compliance portal to activate your free trial and begin using our new features. An active Microsoft 365 E3 subscription is required as a prerequisite to activate the free trial. \n Join the community - https://aka.ms/JoinCCP \n Get started with Microsoft Copilot for Security - Get started with Microsoft Copilot for Security - Training | Microsoft Learn \n Copilot for Security Ninja - How to Become a Microsoft Copilot for Security Ninja: The Complete Level 400 Training \n \n [1] Microsoft Data Security Index annual report highlights evolving generative AI security needs | Microsoft Security Blog \n [2] Cybersecurity Awareness Month: Microsoft resources for security teams | Microsoft Security Blog \n [3] What is AI-Powered Alert Triage? | Intezer \n [4] Randomized Controlled Trial for Copilot for Security ","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})@stringLength":"8890","kudosSumWeight":1,"repliesCount":0,"readOnly":false,"images":{"__typename":"AssociatedImageConnection","edges":[{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLVB2M2pqMg?revision=5\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDI","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLXRQNlAzdQ?revision=5\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDM","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLUthYmJsbA?revision=5\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDQ","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLXd0ZmVXNQ?revision=5\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDU","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLUltUTR3dQ?revision=5\"}"}}],"totalCount":5,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"videos":{"__typename":"VideoConnection","edges":[],"totalCount":0,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"coverImage":{"__typename":"UploadedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00Mzk2MDQxLVB2M2pqMg?revision=5"},"coverImageProperties":{"__typename":"CoverImageProperties","style":"STANDARD","titlePosition":"BOTTOM","altText":""}},"Conversation:conversation:4382024":{"__typename":"Conversation","id":"conversation:4382024","topic":{"__typename":"BlogTopicMessage","uid":4382024},"lastPostingActivityTime":"2025-02-18T09:36:16.766-08:00","solved":false},"User:user:1214124":{"__typename":"User","uid":1214124,"login":"AlexanderZ","registrationData":{"__typename":"RegistrationData","status":null},"deleted":false,"avatar":{"__typename":"UserAvatar","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/dS0xMjE0MTI0LTU1NDI4NWk5NzZCQzdCRjJGRUY2MkVB"},"id":"user:1214124"},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LW16cWgzQw?revision=5\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LW16cWgzQw?revision=5","title":"SEC20_Security_016.jpg","associationType":"COVER","width":2651,"height":1768,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LWJpZWNkTQ?revision=5\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LWJpZWNkTQ?revision=5","title":"SC_Blog1.png","associationType":"BODY","width":286,"height":939,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LTB0MzN4bw?revision=5\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LTB0MzN4bw?revision=5","title":"SC_Blog2.png","associationType":"BODY","width":676,"height":297,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LWlzYjE4Mg?revision=5\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LWlzYjE4Mg?revision=5","title":"SC_Blog3.png","associationType":"BODY","width":628,"height":340,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LWFackVnSg?revision=5\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LWFackVnSg?revision=5","title":"SC_Blog4.png","associationType":"BODY","width":796,"height":28,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LTZKdFY3Qw?revision=5\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LTZKdFY3Qw?revision=5","title":"SC_Blog5.png","associationType":"BODY","width":903,"height":178,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LTdpVzlrMg?revision=5\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LTdpVzlrMg?revision=5","title":"SC_Blog6.png","associationType":"BODY","width":903,"height":216,"altText":""},"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LU9RMHJwdQ?revision=5\"}":{"__typename":"AssociatedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LU9RMHJwdQ?revision=5","title":"SC_Blog7.png","associationType":"BODY","width":2069,"height":795,"altText":""},"BlogTopicMessage:message:4382024":{"__typename":"BlogTopicMessage","subject":"Integrating API data into Microsoft Security Copilot using custom logs and KQL plugins","conversation":{"__ref":"Conversation:conversation:4382024"},"id":"message:4382024","revisionNum":5,"uid":4382024,"depth":0,"board":{"__ref":"Blog:board:microsoft-security-blog"},"author":{"__ref":"User:user:1214124"},"teaser@stripHtml({\"removeProcessingText\":true,\"truncateLength\":-1})":"","introduction":"In this blog post we will discuss how to get data only available through the API to Security Copilot, while benefiting from KQL plugin simplicity.","metrics":{"__typename":"MessageMetrics","views":1107},"postTime":"2025-02-18T09:36:16.766-08:00","lastPublishTime":"2025-02-18T09:36:16.766-08:00","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})":" \n Microsoft Security Copilot (Copilot) is a generative Artificial Intelligence (AI) system for cybersecurity use cases. Copilot is not a monolithic system but is an ecosystem running on a platform that allows data requests from multiple sources using a unique plugin mechanism. Currently, it supports API, GPT, and KQL-based plugins, API and KQL-based plugins can be used to pull external data into Security Copilot. In this blog post we will discuss how both methods can be combined and how we can get data only available through the API to Security Copilot, while benefiting from KQL plugin simplicity. \n KQL vs. API plugins \n KQL-based plugins can gather insights from Microsoft Sentinel workspaces, M365 Defender XDR, and Azure Data Explorer clusters. Such plugins do not require any development skills beyond ability to write KQL queries, do not require any additional authentication mechanism and can be easily extended with new features/queries as needed. API plugins give Copilot the capability to pull data from any external data source if it supports REST API, e.g. allowing Copilot to make Graph API calls. \n KQL and API plugins each have their specific use cases. The KQL option is often chosen for its simplicity and due to certain limitations associated with API plugins: \n \n API plugin request body schemas are limited to a depth of 1, which means they cannot handle deeply nested data structures. \n Output from APIs often needs to be parsed before Security Copilot can ingest it, as Security Copilot, like all other large language models (LLMs) based applications, has limits on how much information it can process at once, known as a \"token limit\". \n API must be publicly available for Copilot to access it, which means API endpoint must be properly secured and authentication method must be supported by Copilot. \n \n The best of both worlds \n A possible solution is to integrate data available only through the API into the Log Analytics workspace, allowing for subsequent querying via KQL. The solution consists of two parts: \n \n Logic App to query API data and send it to Log Analytics (Sentinel) workspace. \n Custom KQL plugin for Security Copilot to query custom tables. \n \n As an example, we will build a solution that allows querying Defender XDR Secure Score historical data, which is currently only available through Graph API. \n Create Logic App to store data retrieved via API in Log Analytics workspace \n We will start with building a simple Logic App to get API data and send it to Log Analytics. While we use Secure Score data, as an example, the same method can be used for any other data that does not change often and suitable for KQL table storage. The Logic App will do the following: \n \n \n Logic App is triggered once a day, in accordance with Secure Score update schedule (once in 24 hours). \n It gets the latest Secure Score via HTTP call to Graph API:\n \n HTTP GET to https://graph.microsoft.com/v1.0/security/secureScores?$top=1: \n Graph API call is authenticated via Managed Identity: \n \n Managed Identity will require SecurityEvents.Read.All permission to get access to Secure Score data: Connect-AzAccount\n$GraphAppId = \"00000003-0000-0000-c000-000000000000\"\n$NameOfMSI = \"LOGIC_APP_NAME”\n$Permission = \"SecurityEvents.Read.All\"\n\n$GraphServicePrincipal = Get-AzADServicePrincipal -AppId $GraphAppId\n$AppRole = $GraphServicePrincipal.AppRole | Where-Object {\n $_.Value -eq $Permission -and $_.Origin -contains \"Application\"\n}\n\nNew-AzADServicePrincipalAppRoleAssignment `\n -ServicePrincipalDisplayName $NameOfMSI `\n -ResourceDisplayName $GraphServicePrincipal.DisplayName `\n -AppRoleId $AppRole.Id \n \n \n \n \n \n Received Secure Score data is sent to Log Analytics workspace using built-in Azure Log Analytics Data Collector connector. For convenience we will split data returned by Secure Score API into two categories to store them in different custom log tables: overall Secure Score values and specific values for each security control.\n \n Managed Identity assigned to the Logic App will have to be granted Log Analytics Contributor role on the chosen Log Analytics workspace: \n \n \n \n \n As a result of running Logic App for the first time, two custom logs will be generated in the selected Log Analytics workspace.\n \n SecureScoreControlsXDR_CL log will contain all information about specific controls: \n \n \n SecureScoreXDR_CL will contain just one entry per day, but it is handy when it comes to tracking Secure Score changes in the organization. \n \n \n \n Create custom KQL Plugin for Security Copilot \n Now when we have our data conveniently stored in Log Analytics workspace, we can proceed to creation of custom KQL plugin. Below is an example of such plugin with some basic skills, but thanks to simplicity of KQL plugins, it can easily be extended and adjusted to ones needs: \n Descriptor:\n Name: SecureScoreXDRPlugin\n DisplayName: Defender XDR Secure Score plugin\n Description: Skills to query and track Microsoft Defender XDR Secure Score \n\nSkillGroups:\n - Format: KQL\n Skills:\n - Name: GetSecureScoreXDR\n DisplayName: Get Defender XDR Secure Score for specific date\n Description: Queries Defender XDR Secure Score current status for Apps, Identity, Devices, Data and Total\n ExamplePrompts:\n - 'Get Defender Secure Score for today'\n - 'Get Secure Score for 2022-01-01'\n - 'What is the current Secure Score'\n - 'What was Secure Score 7 days ago'\n Inputs:\n - Name: date\n Description: The date to query the Secure Score for\n Required: true\n Settings:\n Target: Defender\n Template: |-\n let specifieddate = todatetime('{{date}}');\n SecureScoreControlsXDR_CL\n | where TimeGenerated between (startofday(specifieddate) .. endofday(specifieddate))\n | summarize IdentityScore = sumif(score_d, controlCategory_s == \"Identity\"), AppsScore = sumif(score_d, controlCategory_s == \"Apps\"), DeviceScore = sumif(score_d, controlCategory_s == \"Device\"), DataScore = sumif(score_d, controlCategory_s == \"Data\") by bin(TimeGenerated, 1d)\n | extend TotalScore = (IdentityScore + AppsScore + DeviceScore + DataScore)\n\n - Name: GetSecureScoreXDRChanges\n DisplayName: Get Defender XDR Secure Score controls changes for the past 7 days\n Description: Queries Defender XDR Secure Score and shows changes during the past 7 days\n ExamplePrompts:\n - 'How did secure score change in the past week'\n - 'What are secure score controls changes'\n - 'Show recent changes across secure score controls'\n - 'Show secure score changes for the past 7 days'\n Inputs:\n - Name: date\n Description: The date to query the Secure Score for\n Required: true\n Settings:\n Target: Defender\n Template: |-\n let specifieddate = todatetime('{{date}}');\n let Controls = SecureScoreControlsXDR_CL\n | project TimeGenerated, RecommendationCategory=controlCategory_s, ControlName=controlName_s, Recommendation=description_s, ImplementationStatus=implementationStatus_s, ControlScore = score_d\n | where TimeGenerated >= specifieddate;\n Controls\n | summarize distinctScoreCount = count_distinct(ControlScore) by ControlName\n | where distinctScoreCount > 1\n | join kind=inner (\n Controls\n ) on ControlName\n | summarize TimeGenerated = max(TimeGenerated) by ControlName\n | join kind=inner (\n Controls) on TimeGenerated, ControlName\n | project TimeGenerated, ControlName, RecommendationCategory, Recommendation, ImplementationStatus, ControlScore\n \n \n Now we need to save text above to YAML file and add it as custom KQL plugin: \n \n Once plugin is deployed, we can query and track Secure Score data using Security Copilot: \n \n Conclusion \n Storing non-log data within a Log Analytics workspace is an established practice. This method has been used to allow security analysts easy access to supplementary data via KQL, facilitating its use in KQL queries for detection enrichment purposes. As illustrated in the scenario above, we can still generate alerts based on this data, such as notifications for declining Secure Scores. Additionally, this approach now enables further AI-powered Security Copilot scenarios. ","body@stripHtml({\"removeProcessingText\":true,\"removeSpoilerMarkup\":true,\"removeTocMarkup\":true,\"truncateLength\":-1})@stringLength":"8566","kudosSumWeight":1,"repliesCount":0,"readOnly":false,"images":{"__typename":"AssociatedImageConnection","edges":[{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDE","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LW16cWgzQw?revision=5\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDI","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LWJpZWNkTQ?revision=5\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDM","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LTB0MzN4bw?revision=5\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDQ","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LWlzYjE4Mg?revision=5\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDU","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LWFackVnSg?revision=5\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDY","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LTZKdFY3Qw?revision=5\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDc","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LTdpVzlrMg?revision=5\"}"}},{"__typename":"AssociatedImageEdge","cursor":"MjUuM3wyLjF8b3wyNXxfTlZffDg","node":{"__ref":"AssociatedImage:{\"url\":\"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LU9RMHJwdQ?revision=5\"}"}}],"totalCount":8,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"videos":{"__typename":"VideoConnection","edges":[],"totalCount":0,"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}},"coverImage":{"__typename":"UploadedImage","url":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/images/bS00MzgyMDI0LW16cWgzQw?revision=5"},"coverImageProperties":{"__typename":"CoverImageProperties","style":"STANDARD","titlePosition":"BOTTOM","altText":""}},"CachedAsset:text:en_US-components/community/Navbar-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/community/Navbar-1750857401000","value":{"community":"Community Home","inbox":"Inbox","manageContent":"Manage Content","tos":"Terms of Service","forgotPassword":"Forgot Password","themeEditor":"Theme Editor","edit":"Edit Navigation Bar","skipContent":"Skip to content","gxcuf89792":"Tech Community","external-1":"Events","s-m-b":"Nonprofit Community","windows-server":"Windows Server","education-sector":"Education Sector","driving-adoption":"Driving Adoption","Common-content_management-link":"Content Management","microsoft-learn":"Microsoft Learn","s-q-l-server":"Content Management","partner-community":"Microsoft Partner Community","microsoft365":"Microsoft 365","external-9":".NET","external-8":"Teams","external-7":"Github","products-services":"Products","external-6":"Power Platform","communities-1":"Topics","external-5":"Microsoft Security","planner":"Outlook","external-4":"Microsoft 365","external-3":"Dynamics 365","azure":"Azure","healthcare-and-life-sciences":"Healthcare and Life Sciences","external-2":"Azure","microsoft-mechanics":"Microsoft Mechanics","microsoft-learn-1":"Community","external-10":"Learning Room Directory","microsoft-learn-blog":"Blog","windows":"Windows","i-t-ops-talk":"ITOps Talk","external-link-1":"View All","microsoft-securityand-compliance":"Microsoft Security","public-sector":"Public Sector","community-info-center":"Lounge","external-link-2":"View All","microsoft-teams":"Microsoft Teams","external":"Blogs","microsoft-endpoint-manager":"Microsoft Intune","startupsat-microsoft":"Startups at Microsoft","exchange":"Exchange","a-i":"AI and Machine Learning","io-t":"Internet of Things (IoT)","Common-microsoft365-copilot-link":"Microsoft 365 Copilot","outlook":"Microsoft 365 Copilot","external-link":"Community Hubs","communities":"Products"},"localOverride":false},"CachedAsset:text:en_US-components/community/NavbarHamburgerDropdown-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/community/NavbarHamburgerDropdown-1750857401000","value":{"hamburgerLabel":"Side Menu"},"localOverride":false},"CachedAsset:text:en_US-components/community/BrandLogo-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/community/BrandLogo-1750857401000","value":{"logoAlt":"Khoros","themeLogoAlt":"Brand Logo"},"localOverride":false},"CachedAsset:text:en_US-components/community/NavbarTextLinks-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/community/NavbarTextLinks-1750857401000","value":{"more":"More"},"localOverride":false},"CachedAsset:text:en_US-components/authentication/AuthenticationLink-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/authentication/AuthenticationLink-1750857401000","value":{"title.login":"Sign In","title.registration":"Register","title.forgotPassword":"Forgot Password","title.multiAuthLogin":"Sign In"},"localOverride":false},"CachedAsset:text:en_US-components/nodes/NodeLink-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/nodes/NodeLink-1750857401000","value":{"place":"Place {name}"},"localOverride":false},"CachedAsset:text:en_US-components/tags/TagSubscriptionAction-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/tags/TagSubscriptionAction-1750857401000","value":{"success.follow.title":"Following Tag","success.unfollow.title":"Unfollowed Tag","success.follow.message.followAcrossCommunity":"You will be notified when this tag is used anywhere across the community","success.unfollowtag.message":"You will no longer be notified when this tag is used anywhere in this place","success.unfollowtagAcrossCommunity.message":"You will no longer be notified when this tag is used anywhere across the community","unexpected.error.title":"Error - Action Failed","unexpected.error.message":"An unidentified problem occurred during the action you took. Please try again later.","buttonTitle":"{isSubscribed, select, true {Unfollow} false {Follow} other{}}","unfollow":"Unfollow"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/common/QueryHandler-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/common/QueryHandler-1750857401000","value":{"title":"Query Handler"},"localOverride":false},"CachedAsset:text:en_US-components/community/NavbarDropdownToggle-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/community/NavbarDropdownToggle-1750857401000","value":{"ariaLabelClosed":"Press the down arrow to open the menu"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageListTabs-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageListTabs-1750857401000","value":{"mostKudoed":"{value, select, IDEA {Most Votes} other {Most Likes}}","mostReplies":"Most Replies","mostViewed":"Most Viewed","newest":"{value, select, IDEA {Newest Ideas} OCCASION {Newest Events} other {Newest Topics}}","newestOccasions":"Newest Events","mostRecent":"Most Recent","noReplies":"No Replies Yet","noSolutions":"No Solutions Yet","solutions":"Solutions","mostRecentUserContent":"Most Recent","trending":"Trending","draft":"Drafts","spam":"Spam","abuse":"Abuse","moderation":"Moderation","tags":"Tags","PAST":"Past","UPCOMING":"Upcoming","sortBymostRecent":"Sort By Most Recent","sortBymostRecentUserContent":"Sort By Most Recent","sortBymostKudoed":"Sort By Most Likes","sortBymostReplies":"Sort By Most Replies","sortBymostViewed":"Sort By Most Viewed","sortBynewest":"Sort By Newest Topics","sortBynewestOccasions":"Sort By Newest Events","otherTabs":" Messages list in the {tab} for {conversationStyle}","guides":"Guides","archives":"Archives"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageView/MessageViewInline-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageView/MessageViewInline-1750857401000","value":{"bylineAuthor":"{bylineAuthor}","bylineBoard":"{bylineBoard}","anonymous":"Anonymous","place":"Place {bylineBoard}","gotoParent":"Go to parent {name}"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/common/Pager/PagerLoadMore-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/common/Pager/PagerLoadMore-1750857401000","value":{"loadMore":"Show More"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/common/OverflowNav-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/common/OverflowNav-1750857401000","value":{"toggleText":"More"},"localOverride":false},"CachedAsset:text:en_US-components/users/UserLink-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/users/UserLink-1750857401000","value":{"authorName":"View Profile: {author}","anonymous":"Anonymous"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageSubject-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageSubject-1750857401000","value":{"noSubject":"(no subject)"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageTime-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageTime-1750857401000","value":{"postTime":"Published: {time}","lastPublishTime":"Last Update: {time}","conversation.lastPostingActivityTime":"Last posting activity time: {time}","conversation.lastPostTime":"Last post time: {time}","moderationData.rejectTime":"Rejected time: {time}"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/nodes/NodeIcon-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/nodes/NodeIcon-1750857401000","value":{"contentType":"Content Type {style, select, FORUM {Forum} BLOG {Blog} TKB {Knowledge Base} IDEA {Ideas} OCCASION {Events} other {}} icon"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageUnreadCount-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageUnreadCount-1750857401000","value":{"unread":"{count} unread","comments":"{count, plural, one { unread comment} other{ unread comments}}"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageViewCount-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageViewCount-1750857401000","value":{"textTitle":"{count, plural,one {View} other{Views}}","views":"{count, plural, one{View} other{Views}}"},"localOverride":false},"CachedAsset:text:en_US-components/kudos/KudosCount-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/kudos/KudosCount-1750857401000","value":{"textTitle":"{count, plural,one {{messageType, select, IDEA{Vote} other{Like}}} other{{messageType, select, IDEA{Votes} other{Likes}}}}","likes":"{count, plural, one{like} other{likes}}"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageRepliesCount-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageRepliesCount-1750857401000","value":{"textTitle":"{count, plural,one {{conversationStyle, select, IDEA{Comment} OCCASION{Comment} other{Reply}}} other{{conversationStyle, select, IDEA{Comments} OCCASION{Comments} other{Replies}}}}","comments":"{count, plural, one{Comment} other{Comments}}"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageBody-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageBody-1750857401000","value":{"showMessageBody":"Show More","mentionsErrorTitle":"{mentionsType, select, board {Board} user {User} message {Message} other {}} No Longer Available","mentionsErrorMessage":"The {mentionsType} you are trying to view has been removed from the community.","videoProcessing":"Video is being processed. Please try again in a few minutes.","bannerTitle":"Video provider requires cookies to play the video. Accept to continue or {url} it directly on the provider's site.","buttonTitle":"Accept","urlText":"watch"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/users/UserAvatar-1750857401000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/users/UserAvatar-1750857401000","value":{"altText":"{login}'s avatar","altTextGeneric":"User's avatar"},"localOverride":false}}}},"page":"/tags/TagPage/TagPage","query":{"nodeId":"board:microsoft-security-blog","tagName":"security copilot"},"buildId":"cQon2PUqbQU8la6pXifn2","runtimeConfig":{"buildInformationVisible":false,"logLevelApp":"info","logLevelMetrics":"info","openTelemetryClientEnabled":false,"openTelemetryConfigName":"o365","openTelemetryServiceVersion":"25.3.0","openTelemetryUniverse":"prod","openTelemetryCollector":"http://localhost:4318","openTelemetryRouteChangeAllowedTime":"5000","apolloDevToolsEnabled":false,"inboxMuteWipFeatureEnabled":false},"isFallback":false,"isExperimentalCompile":false,"dynamicIds":["./components/community/Navbar/NavbarWidget.tsx","./components/community/Breadcrumb/BreadcrumbWidget.tsx","./components/customComponent/CustomComponent/CustomComponent.tsx","./components/tags/TagsHeaderWidget/TagsHeaderWidget.tsx","./components/messages/MessageListForNodeByRecentActivityWidget/MessageListForNodeByRecentActivityWidget.tsx","./components/tags/TagSubscriptionAction/TagSubscriptionAction.tsx","./components/external/components/ExternalComponent.tsx","../shared/client/components/common/List/ListGroup/ListGroup.tsx","./components/messages/MessageView/MessageView.tsx","./components/messages/MessageView/MessageViewInline/MessageViewInline.tsx","../shared/client/components/common/Pager/PagerLoadMore/PagerLoadMore.tsx","./components/customComponent/CustomComponentContent/TemplateContent.tsx"],"appGip":true,"scriptLoader":[{"id":"analytics","src":"https://techcommunity.microsoft.com/t5/s/gxcuf89792/pagescripts/1750802071000/analytics.js?page.id=TagPage","strategy":"afterInteractive"}]}

	
		OSZAR »