{ "reviewed": "2026-10-12", "scope": "Principal commercial cloud capabilities; not every setting, API, license SKU, connector, or sovereign-cloud variation.", "capabilities": [ { "id": "def-xdr-incidents", "product": "Defender", "area": "Defender XDR", "feature": "Correlated incident investigation", "capabilities": [ "Cross-workload alert correlation", "Affected assets and evidence", "Unified incident queue" ], "useCase": "Investigate a phishing attack that spreads from email into devices and business accounts.", "service": "mdr", "deliverables": [ "Incident timeline and scope", "Containment and recovery actions" ], "buyer": "Organizations with several Microsoft security workloads", "licensing": "Coverage depends on licensed products, onboarding and available telemetry.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-xdr/microsoft-365-defender" ] }, { "id": "def-threat-hunting", "product": "Defender", "area": "Defender XDR", "feature": "Threat hunting and custom detections", "capabilities": [ "KQL and guided hunting", "Endpoint, email and identity queries", "Scheduled custom detection rules" ], "useCase": "Find suspicious activity that routine alerts miss and detect repeated attack patterns.", "service": "mdr", "deliverables": [ "Environment-specific hunt queries", "Validated detection rules" ], "buyer": "Businesses with security telemetry and specialist investigation needs", "licensing": "Relevant workload licenses and hunting permissions required; raw data retention is limited.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview" ] }, { "id": "def-attack-disruption", "product": "Defender", "area": "Defender XDR", "feature": "Automatic attack disruption", "capabilities": [ "Cross-workload attack recognition", "Device and identity containment", "Reversible response actions" ], "useCase": "Limit ransomware spread while analysts investigate and restore safe access.", "service": "mdr", "deliverables": [ "Approved response policy", "Disruption review and recovery record" ], "buyer": "Organizations with critical shared systems", "licensing": "Requires supported, configured workloads; actions differ by environment. External IAM preview actions excluded.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-xdr/automatic-attack-disruption" ] }, { "id": "def-soc-workflows", "product": "Defender", "area": "Defender XDR", "feature": "SOC workflow integration", "capabilities": [ "Incident APIs", "Hunting APIs", "Security data integration" ], "useCase": "Keep security cases, escalation records and customer reporting aligned.", "service": "automation", "deliverables": [ "Security case integration", "Tested escalation workflow" ], "buyer": "Businesses with service desks or security operations", "licensing": "API permissions, quotas, workload licenses and integration-platform costs apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-xdr/api-overview" ] }, { "id": "def-business-endpoints", "product": "Defender", "area": "Defender for Business", "feature": "Small-business endpoint protection", "capabilities": [ "Simplified policy setup", "Endpoint detection and response", "Automated remediation", "Core vulnerability assessment" ], "useCase": "Give a Detroit small business a managed security baseline for employee devices.", "service": "managed", "deliverables": [ "Device onboarding and baseline", "Recurring security review" ], "buyer": "Small and medium businesses", "licensing": "Defender for Business supports organizations up to 300 users; server protection needs extra licenses.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-business/mdb-overview" ] }, { "id": "def-endpoint-antivirus", "product": "Defender", "area": "Defender for Endpoint", "feature": "Managed antivirus and malware prevention", "capabilities": [ "Behavior-based malware detection", "Cloud-assisted protection", "Protection updates", "Scan performance tuning" ], "useCase": "Protect office computers while keeping legitimate accounting, legal and scheduling software usable.", "service": "managed", "deliverables": [ "Antivirus policy and exclusions review", "Protection health report" ], "buyer": "Law firms, clinics, CPA offices and business owners", "licensing": "Supported endpoint plan and operating system required; capabilities differ by platform.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-endpoint/next-generation-protection" ] }, { "id": "def-endpoint-asr", "product": "Defender", "area": "Defender for Endpoint", "feature": "Attack surface reduction", "capabilities": [ "Risky script controls", "Office process restrictions", "Credential-theft defenses", "Audit and block modes" ], "useCase": "Reduce common malware entry paths without disrupting approved business applications.", "service": "engineering", "deliverables": [ "Tested hardening policy", "Documented exception register" ], "buyer": "Businesses with Windows workstations and servers", "licensing": "Windows-specific prerequisites apply; advanced management and reporting need suitable entitlements.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-overview" ] }, { "id": "def-web-protection", "product": "Defender", "area": "Defender for Endpoint", "feature": "Web and network threat protection", "capabilities": [ "Malicious website protection", "Category-based web filtering", "Custom IP and URL indicators" ], "useCase": "Reduce exposure to phishing websites and unwanted content on business devices.", "service": "managed", "deliverables": [ "Web protection policy", "Exception and blocked-activity review" ], "buyer": "Offices, churches, day cares and mobile workforces", "licensing": "Supported endpoint plan required; browser and protocol limitations affect enforcement.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-endpoint/web-protection-overview" ] }, { "id": "def-removable-media", "product": "Defender", "area": "Defender for Endpoint", "feature": "USB and peripheral controls", "capabilities": [ "Removable-media access rules", "Read, write and execution restrictions", "Device activity reporting" ], "useCase": "Control removable storage use around client files, financial records and shared workstations.", "service": "engineering", "deliverables": [ "Approved-device policy", "Device-control validation report" ], "buyer": "Law firms, clinics and CPA offices", "licensing": "Supported Windows or macOS devices required; server support and feature parity are limited.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-endpoint/device-control-overview" ] }, { "id": "def-endpoint-response", "product": "Defender", "area": "Defender for Endpoint", "feature": "Endpoint investigation and containment", "capabilities": [ "Device isolation", "Investigation packages", "Live response", "Action history" ], "useCase": "Investigate a compromised laptop and contain it before it affects other business systems.", "service": "mdr", "deliverables": [ "Endpoint evidence summary", "Authorized containment and recovery record" ], "buyer": "Businesses needing incident response", "licensing": "Available response actions vary by plan and operating system; the full set requires Endpoint P2.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts" ] }, { "id": "def-endpoint-air", "product": "Defender", "area": "Defender for Endpoint", "feature": "Automated endpoint investigation", "capabilities": [ "Automated evidence investigation", "Remediation recommendations", "Approval-based or automated actions" ], "useCase": "Reduce repetitive alert handling while analysts retain control of consequential actions.", "service": "mdr", "deliverables": [ "Automation and approval settings", "Remediation review record" ], "buyer": "Organizations with recurring endpoint alerts", "licensing": "Requires eligible endpoint subscription; automation settings and platform support determine behavior.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-endpoint/automated-investigations", "https://learn.microsoft.com/en-us/defender-business/mdb-overview" ] }, { "id": "def-endpoint-rollout", "product": "Defender", "area": "Defender for Endpoint", "feature": "Cross-platform deployment and operations", "capabilities": [ "Windows, macOS and Linux onboarding", "Mobile threat protection", "Security ecosystem integration" ], "useCase": "Extend protection to office computers and field devices used by contractors and towing teams.", "service": "support", "deliverables": [ "Deployment and coverage inventory", "Onboarding and health-support runbook" ], "buyer": "Mixed-device businesses and remote teams", "licensing": "Validate supported operating systems and plan-specific features; servers require suitable separate licensing.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint" ] }, { "id": "def-email-impersonation", "product": "Defender", "area": "Defender for Office 365", "feature": "Impersonation and phishing protection", "capabilities": [ "User impersonation detection", "Domain impersonation detection", "Mailbox intelligence" ], "useCase": "Reduce fake supplier, executive and payment-change messages reaching business staff.", "service": "managed", "deliverables": [ "Protected-user and domain policy", "False-positive review process" ], "buyer": "Finance teams, CPA offices and contractors", "licensing": "Advanced impersonation protections require Defender for Office 365 P1 or P2.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-protection-about", "https://learn.microsoft.com/en-us/defender-office-365/mdo-about" ] }, { "id": "def-safe-links", "product": "Defender", "area": "Defender for Office 365", "feature": "Safe Links protection", "capabilities": [ "Time-of-click URL checks", "Email link protection", "Supported Teams and Office link checks" ], "useCase": "Help staff avoid credential theft when opening links in daily collaboration.", "service": "managed", "deliverables": [ "Safe Links configuration", "Client-coverage validation" ], "buyer": "All Microsoft 365 businesses", "licensing": "Defender for Office 365 required; supported clients, link formats and policy settings limit coverage.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-office-365/safe-links-about" ] }, { "id": "def-safe-attachments", "product": "Defender", "area": "Defender for Office 365", "feature": "Safe Attachments protection", "capabilities": [ "Attachment sandbox analysis", "Quarantine controls", "Dynamic Delivery" ], "useCase": "Screen incoming invoices, contracts and applications for malicious attachments.", "service": "managed", "deliverables": [ "Attachment protection policy", "Quarantine handling procedure" ], "buyer": "Law firms, NGOs, clinics and finance teams", "licensing": "Defender for Office 365 required; Dynamic Delivery is limited to Exchange Online mailboxes.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-about" ] }, { "id": "def-collaboration-files", "product": "Defender", "area": "Defender for Office 365", "feature": "Collaboration file malware protection", "capabilities": [ "Safe Attachments for SharePoint", "OneDrive and Teams file protection", "Malicious file investigation" ], "useCase": "Reduce malware spread through shared client files and project document libraries.", "service": "engineering", "deliverables": [ "Collaboration protection settings", "Shared-file response runbook" ], "buyer": "Document-heavy organizations", "licensing": "Defender for Office 365 and supported Microsoft 365 workloads required.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-office-365/mdo-about", "https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about" ] }, { "id": "def-email-investigation", "product": "Defender", "area": "Defender for Office 365", "feature": "Email and campaign investigation", "capabilities": [ "Real-time detections", "Threat Explorer", "URL click investigation", "Campaign analysis" ], "useCase": "Identify who received a malicious email and who may have interacted with it.", "service": "mdr", "deliverables": [ "Recipient and exposure assessment", "Approved message-removal actions" ], "buyer": "Businesses facing phishing and account-compromise risk", "licensing": "P1 provides real-time detections; Threat Explorer and broader actions require P2 and appropriate permissions.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about" ] }, { "id": "def-email-air", "product": "Defender", "area": "Defender for Office 365", "feature": "Automated email investigation", "capabilities": [ "Automated alert investigation", "Compromised-user investigation", "Remediation approval workflows" ], "useCase": "Contain related malicious messages after an email compromise is detected.", "service": "mdr", "deliverables": [ "Investigation automation setup", "Remediation decision log" ], "buyer": "Microsoft 365 businesses with email incident exposure", "licensing": "Defender for Office 365 P2 required; configure approvals and authorized response scope.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-office-365/air-about" ] }, { "id": "def-phishing-training", "product": "Defender", "area": "Defender for Office 365", "feature": "Attack simulation and awareness training", "capabilities": [ "Phishing simulations", "Targeted training assignments", "Simulation results" ], "useCase": "Coach staff who handle payments, donations, patient information or client documents.", "service": "managed", "deliverables": [ "Authorized simulation campaign", "Training completion and learning report" ], "buyer": "Law firms, NGOs, churches, clinics and CPA offices", "licensing": "Eligible Defender for Office 365 P2 entitlement required; scenarios and recipients are agreed in advance.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-get-started" ] }, { "id": "def-mail-security-operations", "product": "Defender", "area": "Microsoft 365 mailbox protection", "feature": "Email filtering and quarantine operations", "capabilities": [ "Anti-spam and anti-malware policies", "Spoofing controls", "Quarantine and submissions", "Post-delivery purge" ], "useCase": "Keep business email usable while managing suspicious mail and false positives.", "service": "support", "deliverables": [ "Mail security configuration review", "Quarantine and release procedure" ], "buyer": "All cloud-mailbox organizations", "licensing": "Baseline protection is included with cloud mailboxes; advanced Defender features need additional entitlement.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-office-365/mdo-about" ] }, { "id": "def-teams-security", "product": "Defender", "area": "Defender for Office 365", "feature": "Teams messaging threat protection", "capabilities": [ "Teams allow and block controls", "User-reported messages", "Message quarantine and purge" ], "useCase": "Reduce malicious external chat activity aimed at staff and business accounts.", "service": "managed", "deliverables": [ "Teams threat policy setup", "Reported-message response process" ], "buyer": "Organizations using Teams with external contacts", "licensing": "Feature availability differs between P1 and P2 and by Teams experience; validate tenant support.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-office-365/mdo-about" ] }, { "id": "def-identity-threats", "product": "Defender", "area": "Defender for Identity", "feature": "Identity threat detection", "capabilities": [ "Credential-abuse detection", "Privilege-change alerts", "Lateral movement signals", "Domain-compromise indicators" ], "useCase": "Detect account misuse before an attacker reaches sensitive files or administrator access.", "service": "mdr", "deliverables": [ "Identity sensor and telemetry validation", "Identity incident investigation" ], "buyer": "Businesses with Active Directory or supported hybrid identity infrastructure", "licensing": "Defender for Identity entitlement and supported sensors or connectors required.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-for-identity/what-is" ] }, { "id": "def-identity-posture", "product": "Defender", "area": "Defender for Identity", "feature": "Identity exposure assessment", "capabilities": [ "Risky configuration findings", "Lateral-movement path analysis", "Identity posture recommendations" ], "useCase": "Remove identity weaknesses that could expose privileged accounts and business systems.", "service": "engineering", "deliverables": [ "Prioritized identity remediation plan", "Post-change validation evidence" ], "buyer": "Organizations with directory infrastructure", "licensing": "Requires eligible identity licensing and sufficient connected identity signals.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-for-identity/what-is" ] }, { "id": "def-identity-response", "product": "Defender", "area": "Defender for Identity", "feature": "Compromised-account response", "capabilities": [ "Identity investigation context", "Unified incident correlation", "Supported account remediation" ], "useCase": "Scope account compromise and coordinate safe access recovery.", "service": "mdr", "deliverables": [ "Account compromise assessment", "Authorized account recovery checklist" ], "buyer": "Businesses with sensitive accounts", "licensing": "Response options depend on identity source, permissions and deployed components.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-for-identity/what-is", "https://learn.microsoft.com/en-us/defender-xdr/automatic-attack-disruption" ] }, { "id": "def-shadow-it", "product": "Defender", "area": "Defender for Cloud Apps", "feature": "Shadow IT and application discovery", "capabilities": [ "Cloud application discovery", "Usage visibility", "Application risk assessment" ], "useCase": "Find unsanctioned file-sharing and business apps before they create unmanaged data exposure.", "service": "engineering", "deliverables": [ "Business application inventory", "Approve, restrict or replace recommendations" ], "buyer": "Organizations with growing SaaS use", "licensing": "Defender for Cloud Apps licensing and supported discovery data sources required.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-cloud-apps/what-is-defender-for-cloud-apps" ] }, { "id": "def-saas-posture", "product": "Defender", "area": "Defender for Cloud Apps", "feature": "SaaS security posture management", "capabilities": [ "Connected-app configuration review", "Security recommendations", "Secure Score integration" ], "useCase": "Correct weak security settings across supported business SaaS applications.", "service": "managed", "deliverables": [ "Prioritized SaaS hardening backlog", "Configuration improvement review" ], "buyer": "Businesses using several cloud applications", "licensing": "Supported app connectors, permissions and eligible licenses required; coverage varies by app.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-cloud-apps/what-is-defender-for-cloud-apps" ] }, { "id": "def-saas-data", "product": "Defender", "area": "Defender for Cloud Apps", "feature": "Sensitive information protection in SaaS", "capabilities": [ "Sensitive-file discovery", "Label-aware policies", "External collaborator controls" ], "useCase": "Reduce unintended sharing of client, donor and employee information in connected cloud apps.", "service": "compliance", "deliverables": [ "Cloud sharing risk assessment", "Data-protection policy configuration" ], "buyer": "Law firms, NGOs and businesses handling confidential records", "licensing": "Connected-app support and Defender for Cloud Apps required; Purview integrations need applicable entitlements.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-cloud-apps/what-is-defender-for-cloud-apps" ] }, { "id": "def-saas-sessions", "product": "Defender", "area": "Defender for Cloud Apps", "feature": "Browser access and session controls", "capabilities": [ "Conditional access integration", "Download restrictions", "Session monitoring", "Malicious upload blocking" ], "useCase": "Let staff work through approved browser sessions while limiting downloads to unmanaged devices.", "service": "engineering", "deliverables": [ "Access and session policy design", "Browser and native-client validation" ], "buyer": "Remote teams handling sensitive business data", "licensing": "Defender for Cloud Apps and applicable identity entitlements required; session controls do not cover all native clients.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-cloud-apps/proxy-intro-aad" ] }, { "id": "def-oauth-governance", "product": "Defender", "area": "Defender for Cloud Apps", "feature": "OAuth application governance", "capabilities": [ "App permission visibility", "Anomalous app activity alerts", "App governance policies", "Risky app remediation" ], "useCase": "Identify business integrations with excessive access or suspicious data use.", "service": "managed", "deliverables": [ "OAuth application risk register", "Approved restriction and remediation actions" ], "buyer": "Businesses using connected apps and automation", "licensing": "Supported Entra, Google or Salesforce integrations and applicable Cloud Apps licensing required.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-manage-app-governance" ] }, { "id": "def-vulnerability-inventory", "product": "Defender", "area": "Defender Vulnerability Management", "feature": "Asset and software vulnerability visibility", "capabilities": [ "Software inventory", "Device vulnerability assessment", "Exposure recommendations" ], "useCase": "Identify vulnerable applications across business devices and plan practical fixes.", "service": "managed", "deliverables": [ "Software and vulnerability inventory", "Remediation ownership register" ], "buyer": "Businesses with distributed devices", "licensing": "Core and premium features differ by endpoint or vulnerability-management plan and platform.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-vulnerability-management/defender-vulnerability-management" ] }, { "id": "def-vulnerability-remediation", "product": "Defender", "area": "Defender Vulnerability Management", "feature": "Risk-based remediation management", "capabilities": [ "Threat-informed prioritization", "Critical-asset context", "Remediation tasks", "Progress tracking" ], "useCase": "Fix exploitable weaknesses affecting important business systems before lower-impact issues.", "service": "engineering", "deliverables": [ "Prioritized remediation backlog", "Verified closure and exceptions report" ], "buyer": "Businesses with patching backlogs", "licensing": "Applicable vulnerability-management licensing required; Intune integration needs its own eligibility.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-vulnerability-management/defender-vulnerability-management" ] }, { "id": "def-advanced-asset-assessment", "product": "Defender", "area": "Defender Vulnerability Management", "feature": "Certificate, extension and firmware assessment", "capabilities": [ "Certificate inventory and weaknesses", "Browser-extension risk", "Hardware and firmware findings" ], "useCase": "Find expiring certificates, risky browser add-ons and device weaknesses outside ordinary patch lists.", "service": "managed", "deliverables": [ "Specialist asset risk register", "Renewal and remediation schedule" ], "buyer": "Organizations with varied endpoint software and hardware", "licensing": "These assessments can require premium vulnerability-management entitlement; platform support varies.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-vulnerability-management/defender-vulnerability-management-capabilities", "https://learn.microsoft.com/en-us/defender-vulnerability-management/defender-vulnerability-management" ] }, { "id": "def-baseline-assessment", "product": "Defender", "area": "Defender Vulnerability Management", "feature": "Security baseline and network-share assessment", "capabilities": [ "Benchmark configuration assessments", "Network-share exposure review", "Authenticated Windows assessment" ], "useCase": "Check security settings and file-share weaknesses against agreed technical baselines.", "service": "compliance", "deliverables": [ "Baseline findings and exceptions", "Remediation evidence pack" ], "buyer": "Organizations preparing customer assurance or security reviews", "licensing": "Premium vulnerability-management features and supported platforms required; technical assessment is not certification.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-vulnerability-management/defender-vulnerability-management-capabilities" ] }, { "id": "def-cloud-foundation", "product": "Defender", "area": "Defender for Cloud", "feature": "Cloud configuration and asset posture", "capabilities": [ "Multicloud resource inventory", "Security recommendations", "Foundational secure score" ], "useCase": "Find avoidable Azure, AWS and Google Cloud configuration risks.", "service": "engineering", "deliverables": [ "Cloud security baseline review", "Prioritized configuration corrections" ], "buyer": "Businesses operating cloud workloads", "licensing": "Foundational CSPM and paid Defender CSPM differ; connector setup and supported resources determine coverage.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management" ] }, { "id": "def-cloud-attack-paths", "product": "Defender", "area": "Defender for Cloud", "feature": "Cloud attack-path and exposure analysis", "capabilities": [ "Cloud security graph", "Attack-path analysis", "Risk hunting", "Sensitive-data context" ], "useCase": "Prioritize cloud weaknesses that could expose important applications or confidential data.", "service": "engineering", "deliverables": [ "Critical attack-path assessment", "Remediation sequence and owners" ], "buyer": "Organizations with connected cloud resources", "licensing": "Advanced analysis requires paid Defender CSPM and supported resource coverage.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management" ] }, { "id": "def-cloud-compliance", "product": "Defender", "area": "Defender for Cloud", "feature": "Cloud security control assessment", "capabilities": [ "Regulatory compliance assessments", "Governance assignments", "Remediation tracking" ], "useCase": "Prepare technical evidence for customer security reviews and applicable control frameworks.", "service": "compliance", "deliverables": [ "Control findings and evidence", "Owner-based corrective action plan" ], "buyer": "Regulated and assurance-driven businesses", "licensing": "Paid-plan and framework availability varies; dashboards do not establish legal compliance or certification.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management" ] }, { "id": "def-server-protection", "product": "Defender", "area": "Defender for Servers", "feature": "Hybrid and cloud server protection", "capabilities": [ "Server EDR", "Vulnerability assessment", "File integrity monitoring", "Just-in-time access options" ], "useCase": "Protect the servers behind business applications and limit risky administrative access.", "service": "mdr", "deliverables": [ "Server coverage and response baseline", "Server incident and exposure review" ], "buyer": "Businesses with Windows or Linux servers", "licensing": "Defender for Servers P1/P2 features differ; file monitoring and access capabilities require suitable plan and environment.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-servers-overview" ] }, { "id": "def-container-security", "product": "Defender", "area": "Defender for Containers", "feature": "Container and Kubernetes protection", "capabilities": [ "Image vulnerability assessment", "Cluster configuration review", "Runtime threat detection", "Sensor coverage monitoring" ], "useCase": "Reduce security risk in containerized business applications before and after deployment.", "service": "engineering", "deliverables": [ "Container hardening and scan setup", "Runtime response runbook" ], "buyer": "Software businesses and organizations using Kubernetes", "licensing": "Defender for Containers and supported cloud/cluster configuration required; preview-only coverage excluded.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction" ] }, { "id": "def-storage-security", "product": "Defender", "area": "Defender for Storage", "feature": "Cloud file and storage threat protection", "capabilities": [ "Storage anomaly detection", "Malware scanning", "Sensitive-data threat context", "Event-driven response integration" ], "useCase": "Screen uploads and investigate unusual access to cloud-held business documents.", "service": "mdr", "deliverables": [ "Storage protection configuration", "Malware handling and response workflow" ], "buyer": "Businesses with upload portals or Azure storage", "licensing": "Separate storage plan and scanning charges can apply; automated quarantine requires configured integration.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction" ] }, { "id": "def-database-security", "product": "Defender", "area": "Defender for Databases", "feature": "Database threat and vulnerability management", "capabilities": [ "SQL vulnerability assessments", "Suspicious access detection", "SQL injection alerts" ], "useCase": "Protect customer and financial records held in supported SQL systems.", "service": "mdr", "deliverables": [ "Database security assessment", "Database alert response procedure" ], "buyer": "Businesses with SQL-backed applications", "licensing": "Select the correct database protection plan and supported deployment; database-engine coverage differs.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-introduction" ] }, { "id": "def-app-service-security", "product": "Defender", "area": "Defender for App Service", "feature": "Web application threat monitoring", "capabilities": [ "App Service attack detection", "Workload security alerts", "Investigation context" ], "useCase": "Detect suspicious activity against business websites and application services hosted in Azure.", "service": "mdr", "deliverables": [ "Application monitoring configuration", "Application incident runbook" ], "buyer": "Businesses running Azure App Service applications", "licensing": "Requires Defender for App Service coverage for supported workloads; does not replace application security testing.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction" ] }, { "id": "def-secret-control-plane", "product": "Defender", "area": "Defender for Cloud", "feature": "Secret-store and control-plane monitoring", "capabilities": [ "Key Vault access threat detection", "Suspicious resource-management activity", "Cloud alert correlation" ], "useCase": "Detect misuse of application secrets and suspicious changes to Azure resources.", "service": "mdr", "deliverables": [ "Key Vault and control-plane monitoring", "Secret exposure response procedure" ], "buyer": "Cloud application and IT teams", "licensing": "Relevant Key Vault and Resource Manager protection plans and resource support required.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-key-vault-introduction", "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction" ] }, { "id": "def-api-security", "product": "Defender", "area": "Defender for APIs", "feature": "Business API security", "capabilities": [ "API inventory", "Authentication exposure findings", "Sensitive data classification", "Runtime threat detection" ], "useCase": "Identify unused or exposed APIs and investigate attacks against business integrations.", "service": "engineering", "deliverables": [ "API security findings and hardening plan", "API incident monitoring setup" ], "buyer": "Businesses exposing customer or operational APIs", "licensing": "Defender for APIs runtime coverage requires supported APIs published through Azure API Management.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-apis-introduction" ] }, { "id": "def-ai-workload-security", "product": "Defender", "area": "Defender for AI Services", "feature": "Generative AI threat monitoring", "capabilities": [ "Prompt-related threat alerts", "AI activity monitoring", "Defender XDR incident integration" ], "useCase": "Detect suspicious interactions with supported AI applications that handle business information.", "service": "mdr", "deliverables": [ "AI workload monitoring setup", "AI incident investigation procedure" ], "buyer": "Businesses deploying Azure generative AI applications", "licensing": "GA coverage applies to supported Azure AI text models; image/audio tokens are not scanned; separate consumption charges apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/defender-for-cloud/ai-threat-protection" ] }, { "id": "def-devsecops", "product": "Defender", "area": "Defender for Cloud", "feature": "Code-to-cloud security operations", "capabilities": [ "DevOps security findings", "Infrastructure-as-code exposure", "Secret findings", "Code-to-cloud risk context" ], "useCase": "Help developers fix source and deployment weaknesses affecting live business applications.", "service": "engineering", "deliverables": [ "Repository and pipeline security review", "Developer remediation backlog" ], "buyer": "Software teams using GitHub, Azure DevOps or GitLab", "licensing": "Connector, repository scanning and paid CSPM entitlements vary; validate each capability before rollout.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction", "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management" ] }, { "id": "def-ot-security", "product": "Defender", "area": "Defender for IoT", "feature": "Operational technology monitoring", "capabilities": [ "Agentless network visibility", "OT device inventory", "Protocol-aware anomaly detection", "Vulnerability findings" ], "useCase": "Understand and monitor connected workshop or industrial equipment without installing endpoint agents on it.", "service": "mdr", "deliverables": [ "OT monitoring design and inventory", "Site-specific alert response runbook" ], "buyer": "Manufacturers and businesses with eligible operational equipment", "licensing": "Site-based OT licensing and sensors required; deployment needs operational approval. Unified Defender portal experience is Preview.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/overview", "https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/license-and-trial-license-extention" ] }, { "id": "def-enterprise-iot", "product": "Defender", "area": "Defender for IoT", "feature": "Enterprise connected-device visibility", "capabilities": [ "Printer and smart-device discovery", "IoT exposure findings", "Defender for Endpoint integration" ], "useCase": "Find unmanaged printers and connected office equipment missed by the laptop inventory.", "service": "engineering", "deliverables": [ "Connected-device inventory", "Segmentation and remediation recommendations" ], "buyer": "Clinics, offices, churches and shared facilities", "licensing": "Eligible enterprise IoT/Endpoint entitlement and discovery coverage required; not all devices support direct remediation.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/overview" ] }, { "id": "def-external-discovery", "product": "Defender", "area": "Defender EASM", "feature": "Internet-facing asset discovery", "capabilities": [ "Domain and host discovery", "Related infrastructure inventory", "Active and historical asset visibility" ], "useCase": "Find forgotten business domains and exposed web infrastructure across acquisitions or old projects.", "service": "managed", "deliverables": [ "Validated external asset inventory", "Asset ownership and cleanup plan" ], "buyer": "Businesses with websites, domains and public infrastructure", "licensing": "Requires Defender EASM deployment and applicable Azure charges; inferred ownership must be validated.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/external-attack-surface-management/overview" ] }, { "id": "def-external-hygiene", "product": "Defender", "area": "Defender EASM", "feature": "External security hygiene monitoring", "capabilities": [ "Internet exposure dashboards", "Web-component vulnerability signals", "Certificate and infrastructure hygiene" ], "useCase": "Prioritize external weaknesses before customers or attackers find them.", "service": "managed", "deliverables": [ "External exposure findings", "Owner-assigned remediation review" ], "buyer": "Businesses with public-facing services", "licensing": "External findings are observations requiring validation; EASM is not a substitute for authenticated testing.", "sourceUrls": [ "https://learn.microsoft.com/en-us/azure/external-attack-surface-management/understanding-dashboards", "https://learn.microsoft.com/en-us/azure/external-attack-surface-management/overview" ] }, { "id": "def-threat-intelligence", "product": "Defender", "area": "Threat analytics in Defender", "feature": "Threat intelligence and exposure briefings", "capabilities": [ "Threat research reports", "Impacted-asset context", "Exposure and mitigation guidance" ], "useCase": "Translate emerging threats into relevant actions for the business and SOC.", "service": "mdr", "deliverables": [ "Business-relevant threat briefing", "Targeted hunting and mitigation tasks" ], "buyer": "Businesses receiving managed security services", "licensing": "Eligible Defender entitlement needed; Endpoint P1 alone is insufficient. Standalone Defender TI is retired; preview-only experiences excluded.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-xdr/threat-analytics", "https://learn.microsoft.com/th-th/defender/threat-intelligence/using-tags" ] }, { "id": "def-exposure-management", "product": "Defender", "area": "Security Exposure Management", "feature": "Cross-environment exposure prioritization", "capabilities": [ "Unified asset security context", "Endpoint and cloud exposure visibility", "Critical-asset prioritization" ], "useCase": "Choose security improvements based on important business assets across the environment.", "service": "managed", "deliverables": [ "Business-critical exposure register", "Prioritized improvement roadmap" ], "buyer": "Organizations with multiple security workloads", "licensing": "Adjacent Defender-portal capability; eligibility, connectors and data coverage must be verified separately.", "sourceUrls": [ "https://learn.microsoft.com/en-us/security-exposure-management/microsoft-security-exposure-management" ] }, { "id": "purview-classification", "product": "Purview", "area": "Information protection", "feature": "Sensitive data discovery and custom classification", "capabilities": [ "Built-in information detectors", "Custom patterns, keywords and confidence rules", "Credential-pattern detection where licensed" ], "useCase": "Find client identifiers, patient information and financial records before designing protection.", "service": "compliance", "deliverables": [ "Sensitive-data inventory", "Tested classification rulebook" ], "buyer": "Compliance officer; practice owner", "licensing": "Credential detectors require advanced entitlements; validate workload-specific detection.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/sit-sensitive-information-type-learn-about" ] }, { "id": "purview-exact-match", "product": "Purview", "area": "Information protection", "feature": "Exact data match classification", "capabilities": [ "Match specific protected database values", "Hash-based reference-data matching", "Refresh sensitive reference datasets" ], "useCase": "Identify actual customer or employee records with fewer irrelevant alerts.", "service": "engineering", "deliverables": [ "Reference-data matching pipeline", "Detection accuracy report" ], "buyer": "Security lead; data owner", "licensing": "Requires eligible classification rights and a maintained reference dataset.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/sit-learn-about-exact-data-match-based-sits" ] }, { "id": "purview-classifiers", "product": "Purview", "area": "Information protection", "feature": "Document and content classifiers", "capabilities": [ "Pretrained document classifiers", "Custom classifiers trained on business samples", "Conditions for labeling, retention and DLP" ], "useCase": "Recognize contracts, bids and legal documents that simple number patterns miss.", "service": "engineering", "deliverables": [ "Validated document classifier", "Representative evaluation set" ], "buyer": "Legal operations; records manager", "licensing": "Custom classifiers support English; encrypted content is excluded.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/trainable-classifiers-learn-about" ] }, { "id": "purview-activity", "product": "Purview", "area": "Information protection", "feature": "Data activity and labeling visibility", "capabilities": [ "Filter label and DLP activity", "Review file-egress events", "Save investigation views" ], "useCase": "Show managers where sensitive information moves and where staff need support.", "service": "managed", "deliverables": [ "Monthly data-risk report", "Prioritized policy-tuning backlog" ], "buyer": "CISO; office manager", "licensing": "Activity explorer is delayed telemetry with a 30-day view, not real-time monitoring.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer" ] }, { "id": "purview-labels", "product": "Purview", "area": "Information protection", "feature": "Sensitivity labels and document encryption", "capabilities": [ "Classification labels and visual markings", "Rights-based encryption", "Default labels and downgrade justification" ], "useCase": "Protect confidential client documents when staff share or download them.", "service": "engineering", "deliverables": [ "Published label taxonomy", "Document sharing acceptance tests" ], "buyer": "Law firm; CPA office; clinic", "licensing": "Manual and advanced labeling entitlements differ; validate supported apps.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/sensitivity-labels" ] }, { "id": "purview-autolabel", "product": "Purview", "area": "Information protection", "feature": "Automatic sensitivity labeling", "capabilities": [ "Client recommendations and automatic labels", "Service-side Exchange, SharePoint and OneDrive policies", "Simulation before enforcement" ], "useCase": "Reduce manual handling mistakes when large volumes of sensitive documents arrive.", "service": "automation", "deliverables": [ "Auto-labeling policies", "Simulation and rollout report" ], "buyer": "Compliance lead; growing business", "licensing": "Advanced licensing required; Exchange service labeling covers transit, not stored mail.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically" ] }, { "id": "purview-container-labels", "product": "Purview", "area": "Information protection", "feature": "Workspace and meeting sensitivity", "capabilities": [ "Labels for Teams, groups and SharePoint sites", "Control external sharing and unmanaged-device access", "Supported meeting and chat protections" ], "useCase": "Create confidential project workspaces with consistent collaboration settings.", "service": "engineering", "deliverables": [ "Workspace sensitivity standards", "Tested collaboration configurations" ], "buyer": "Professional services; contractor", "licensing": "Meeting protections and container settings have separate prerequisites.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/sensitivity-labels" ] }, { "id": "purview-scanner", "product": "Purview", "area": "Information protection", "feature": "On-premises information protection", "capabilities": [ "Scan supported file repositories", "Identify and label sensitive files", "Apply configured protection policies" ], "useCase": "Bring legacy file shares into a consistent data-protection programme.", "service": "engineering", "deliverables": [ "Repository discovery report", "Scanner deployment and support runbook" ], "buyer": "Office manager; infrastructure lead", "licensing": "Requires scanner infrastructure, service permissions and eligible labeling rights.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/deploy-scanner" ] }, { "id": "purview-message-encryption", "product": "Purview", "area": "Information protection", "feature": "Protected business email", "capabilities": [ "Encrypt email and supported attachments", "Restrict forwarding and content use", "Apply mail-flow protection rules" ], "useCase": "Exchange tax records, contracts or referral documents with intended recipients.", "service": "support", "deliverables": [ "Protected-email configuration", "Staff sending and recipient guide" ], "buyer": "CPA office; law firm; clinic", "licensing": "Requires eligible rights-management licensing and supported recipient workflows.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/ome" ] }, { "id": "purview-customer-key", "product": "Purview", "area": "Information protection", "feature": "Customer-controlled service encryption", "capabilities": [ "Customer Key for supported cloud workloads", "Data encryption policies", "Customer-managed key lifecycle" ], "useCase": "Support customers that require more control over encryption of cloud-stored business data.", "service": "engineering", "deliverables": [ "Key-management design", "Recovery and rotation procedures" ], "buyer": "Regulated business; security architect", "licensing": "Eligible workload licensing and key-management prerequisites apply; cloud data at rest only.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/customer-key-overview" ] }, { "id": "purview-double-key", "product": "Purview", "area": "Information protection", "feature": "Double Key Encryption for restricted records", "capabilities": [ "Two-key protection for selected content", "Customer-controlled key service", "Sensitivity-label integration" ], "useCase": "Protect a small set of highly restricted records with customer-held keys.", "service": "engineering", "deliverables": [ "Restricted-data encryption pilot", "Key-service recovery plan" ], "buyer": "Legal director; regulated enterprise", "licensing": "Advanced licensing and customer-hosted key service; disables Copilot and several cloud processing features for protected content.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/double-key-encryption" ] }, { "id": "purview-lockbox", "product": "Purview", "area": "Information protection", "feature": "Customer Lockbox approval", "capabilities": [ "Customer approval of eligible Microsoft support access", "Time-bound request workflow", "Auditable access decisions" ], "useCase": "Give the business a formal approval step before eligible support access to customer content.", "service": "compliance", "deliverables": [ "Support-access approval procedure", "Lockbox configuration evidence" ], "buyer": "Compliance officer; IT manager", "licensing": "Available only with eligible plans; applies to supported Microsoft service operations.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/customer-lockbox-requests" ] }, { "id": "purview-m365-dlp", "product": "Purview", "area": "Data loss prevention", "feature": "Email and collaboration DLP", "capabilities": [ "Content-aware Exchange rules", "SharePoint and OneDrive sharing controls", "Teams message controls where entitled" ], "useCase": "Reduce accidental disclosure of client, financial or patient information.", "service": "engineering", "deliverables": [ "DLP policy baseline", "Business workflow test results" ], "buyer": "Law firm; NGO; clinic; CPA office", "licensing": "Entitlements vary across Exchange, file collaboration and Teams.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp" ] }, { "id": "purview-endpoint-dlp", "product": "Purview", "area": "Data loss prevention", "feature": "Endpoint information protection", "capabilities": [ "Monitor or restrict USB and print actions", "Control clipboard and browser upload paths", "App and device-specific policy controls" ], "useCase": "Reduce sensitive-file leakage from office computers and remote staff devices.", "service": "engineering", "deliverables": [ "Endpoint DLP rollout", "Device coverage and exception register" ], "buyer": "SMB owner; security lead", "licensing": "Requires eligible Endpoint DLP rights and supported, onboarded Windows or macOS devices.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/endpoint-dlp-learn-about" ] }, { "id": "purview-cloud-dlp", "product": "Purview", "area": "Data loss prevention", "feature": "Cloud-app and analytics data protection", "capabilities": [ "Supported cloud-app DLP integrations", "Fabric and Power BI policy coverage", "Connected-app coverage where available" ], "useCase": "Protect sensitive exports and files across approved business applications.", "service": "engineering", "deliverables": [ "Application coverage matrix", "Tested cross-app protection policies" ], "buyer": "Finance leader; IT manager", "licensing": "Connector and application entitlements vary; some connected-app integrations are preview.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp" ] }, { "id": "purview-browser-dlp", "product": "Purview", "area": "Data loss prevention", "feature": "Browser controls for cloud and AI apps", "capabilities": [ "DLP in Edge for Business", "Managed and unmanaged-device scenarios", "Control transfers involving supported cloud apps" ], "useCase": "Reduce staff uploading customer information into unsanctioned web and AI tools.", "service": "engineering", "deliverables": [ "Browser protection rollout", "Approved-app and exception list" ], "buyer": "Office manager; security lead", "licensing": "Prerequisites vary by scenario; unmanaged-app protection can incur consumption charges.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/dlp-browser-dlp-learn" ] }, { "id": "purview-network-dlp", "product": "Purview", "area": "Data loss prevention", "feature": "Network data protection", "capabilities": [ "Classify supported outbound web content", "Control uploads, prompts and web submissions", "Integrate with Microsoft Entra Global Secure Access" ], "useCase": "Extend sensitive-data controls to supported network paths outside Microsoft 365.", "service": "engineering", "deliverables": [ "Network DLP design", "Traffic coverage validation" ], "buyer": "Multi-site business; security architect", "licensing": "Purview and Entra licensing apply; coverage and release status depend on integration.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/dlp-network-data-security-learn" ] }, { "id": "purview-ai-dlp", "product": "Purview", "area": "Data loss prevention", "feature": "Sensitive data controls for AI", "capabilities": [ "Inspect supported AI interaction paths", "Use labels and DLP to reduce exposure", "Assess app-specific protection coverage" ], "useCase": "Let staff use AI with explicit rules for confidential business information.", "service": "automation", "deliverables": [ "AI data-handling controls", "Scenario-based leakage tests" ], "buyer": "Business owner; AI programme lead", "licensing": "Copilot-specific DLP and other AI controls vary by feature, app and preview status.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/ai-microsoft-purview" ] }, { "id": "purview-dlp-operations", "product": "Purview", "area": "Data loss prevention", "feature": "DLP monitoring and response", "capabilities": [ "Alert triage and incident investigation", "Policy simulation and exception tuning", "Defender incident integration" ], "useCase": "Keep protection effective while resolving staff work disruptions quickly.", "service": "mdr", "deliverables": [ "Data-loss incident playbook", "Monthly detection and tuning report" ], "buyer": "CISO; operations manager", "licensing": "Alert capabilities and integration depend on licenses and configured locations.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp" ] }, { "id": "purview-insider", "product": "Purview", "area": "Insider risk", "feature": "Insider risk detection and case handling", "capabilities": [ "Correlate departure and exfiltration signals", "Investigate potential data theft or leakage", "Pseudonymized identities and restricted case access" ], "useCase": "Identify unusual data removal while protecting employee privacy through controlled review.", "service": "managed", "deliverables": [ "Insider-risk policies", "Human review and escalation procedure" ], "buyer": "HR; legal; CISO", "licensing": "Eligible Insider Risk Management entitlement, signals and regional availability required.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/insider-risk-management-solution-overview" ] }, { "id": "purview-adaptive", "product": "Purview", "area": "Insider risk", "feature": "Adaptive data protection", "capabilities": [ "Risk-based DLP controls", "Dynamic user-risk levels", "Optional retention and access-control integrations" ], "useCase": "Tighten controls when risky behaviour increases without treating every employee identically.", "service": "engineering", "deliverables": [ "Adaptive control policy", "Risk-threshold validation report" ], "buyer": "Security leader; HR", "licensing": "Requires connected solution entitlements; retention and Conditional Access integrations are preview.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/insider-risk-management-adaptive-protection" ] }, { "id": "purview-barriers", "product": "Purview", "area": "Insider risk", "feature": "Information barriers", "capabilities": [ "Restrict collaboration between defined groups", "Enforce Teams, SharePoint and OneDrive boundaries", "Apply segment-based policies" ], "useCase": "Separate conflicting client matters or restricted internal teams.", "service": "compliance", "deliverables": [ "Communication boundary design", "Cross-group access test evidence" ], "buyer": "Law firm; financial services", "licensing": "Eligible Information Barriers licensing; this is not an Exchange email barrier.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/information-barriers" ] }, { "id": "purview-communications", "product": "Purview", "area": "Compliance operations", "feature": "Communication compliance review", "capabilities": [ "Review flagged business-conduct communications", "Detect sensitive disclosures", "Human triage, remediation and pseudonymization" ], "useCase": "Support a documented investigation process for inappropriate or risky business communications.", "service": "compliance", "deliverables": [ "Supervision policy set", "Reviewer workflow and evidence log" ], "buyer": "HR; compliance officer", "licensing": "Licensing and connector coverage vary; detections require human review.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/communication-compliance-solution-overview" ] }, { "id": "purview-audit", "product": "Purview", "area": "Compliance operations", "feature": "Audit search and evidence collection", "capabilities": [ "Search user and administrator events", "Export audit results", "Use audit APIs for investigation workflows" ], "useCase": "Determine who changed permissions, accessed content or performed an administrative action.", "service": "mdr", "deliverables": [ "Audit readiness baseline", "Repeatable investigation searches" ], "buyer": "IT manager; legal; security lead", "licensing": "Audit Standard normally retains 180 days; supported activity coverage varies.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/audit-solutions-overview" ] }, { "id": "purview-audit-premium", "product": "Purview", "area": "Compliance operations", "feature": "Advanced audit retention and investigation", "capabilities": [ "Longer retention for eligible events", "Custom audit retention policies", "Additional investigation properties" ], "useCase": "Preserve an investigation trail for incidents discovered months after the event.", "service": "compliance", "deliverables": [ "Audit retention design", "Retention and access verification" ], "buyer": "Regulated business; legal director", "licensing": "Premium entitlement required; ten-year retention needs a separate add-on and policy.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/audit-solutions-overview" ] }, { "id": "purview-ediscovery", "product": "Purview", "area": "Compliance operations", "feature": "eDiscovery search, preservation and export", "capabilities": [ "Case-based content searches", "Investigation holds", "Controlled evidence exports" ], "useCase": "Preserve and collect business records for disputes and internal investigations.", "service": "compliance", "deliverables": [ "Case and hold configuration", "Search and export evidence register" ], "buyer": "Law firm; legal director", "licensing": "Capabilities depend on eDiscovery licensing; retention is not a backup service.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/edisc" ] }, { "id": "purview-ediscovery-review", "product": "Purview", "area": "Compliance operations", "feature": "Advanced eDiscovery review", "capabilities": [ "Review sets, tagging and analytics", "OCR, conversation context and deduplication", "Cloud-attachment and version collection" ], "useCase": "Reduce the material legal teams need to review while retaining context.", "service": "compliance", "deliverables": [ "Prepared review set", "Documented review and export workflow" ], "buyer": "Legal team; regulated enterprise", "licensing": "Premium eDiscovery rights required; some advanced query and guest-review options are preview.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/edisc" ] }, { "id": "purview-retention", "product": "Purview", "area": "Records and lifecycle", "feature": "Retention and defensible deletion", "capabilities": [ "Retention policies and item labels", "Automatic application and adaptive scopes where licensed", "Supported Copilot interaction retention" ], "useCase": "Keep business records for an approved period and remove obsolete material systematically.", "service": "compliance", "deliverables": [ "Business retention schedule", "Implemented retention and deletion policies" ], "buyer": "SMB owner; records manager", "licensing": "Workload, auto-application and adaptive-scope entitlements differ.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/data-lifecycle-management" ] }, { "id": "purview-records", "product": "Purview", "area": "Records and lifecycle", "feature": "Records management and disposition", "capabilities": [ "File plans and record declarations", "Event-based retention", "Disposition review and deletion evidence" ], "useCase": "Manage contracts, HR records and other formal records through an approved lifecycle.", "service": "compliance", "deliverables": [ "Configured records file plan", "Disposition approval and evidence workflow" ], "buyer": "Compliance officer; legal operations", "licensing": "Advanced records entitlements required; regulatory-record controls require deliberate design.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/records-management" ] }, { "id": "purview-compliance-manager", "product": "Purview", "area": "Compliance operations", "feature": "Compliance assessments and evidence tracking", "capabilities": [ "Assessment templates and custom assessments", "Owner-assigned improvement actions", "Risk-based progress and evidence tracking" ], "useCase": "Turn compliance requirements into owned tasks, technical changes and reviewable evidence.", "service": "compliance", "deliverables": [ "Prioritized controls action plan", "Maintained assessment evidence pack" ], "buyer": "Clinic; CPA office; NGO; regulated business", "licensing": "Template availability depends on licensing; a score does not certify compliance.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/compliance-manager" ] }, { "id": "purview-privileged-access", "product": "Purview", "area": "Compliance operations", "feature": "Exchange privileged task approval", "capabilities": [ "Just-in-time privileged Exchange tasks", "Approver groups", "Time-bound approval workflow" ], "useCase": "Reduce standing administrative access to sensitive mailbox operations.", "service": "engineering", "deliverables": [ "Privileged task policies", "Approval and emergency-access procedure" ], "buyer": "IT manager; security lead", "licensing": "Eligible Purview Privileged Access Management rights; scope is Exchange Online.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/privileged-access-management-solution-overview" ] }, { "id": "purview-collection", "product": "Purview", "area": "Data security posture", "feature": "Controlled collection of data-risk signals", "capabilities": [ "Choose monitored sources and activities", "Filter collected events", "Scope AI interaction collection" ], "useCase": "Collect the signals needed for security while limiting unnecessary information intake.", "service": "compliance", "deliverables": [ "Signal collection matrix", "Documented collection policies" ], "buyer": "Privacy lead; security operations", "licensing": "Underlying workload licensing applies; collection itself does not enforce DLP.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/collection-policies-solution-overview" ] }, { "id": "purview-data-investigation", "product": "Purview", "area": "Data security posture", "feature": "Data Security Investigations", "capabilities": [ "Scope exposed data", "Semantic search and AI categorization", "Examine data risks with human validation" ], "useCase": "Identify what information an incident exposed and prioritize containment work.", "service": "mdr", "deliverables": [ "Exposure assessment report", "Remediation task register" ], "buyer": "CISO; incident manager", "licensing": "Azure-linked consumption, role and regional prerequisites require validation.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/data-security-investigations", "https://learn.microsoft.com/en-us/purview/data-security-investigations-get-started" ] }, { "id": "purview-dspm", "product": "Purview", "area": "Data security posture", "feature": "Data Security Posture Management", "capabilities": [ "Inventory sensitive-data risks", "Assess access and protection gaps", "Track prioritized remediation" ], "useCase": "Find weak data controls before expanding AI use or external collaboration.", "service": "managed", "deliverables": [ "Data exposure baseline", "Recurring remediation dashboard" ], "buyer": "Business owner; CISO", "licensing": "Expanded DSPM is preview in Microsoft's overview; tenant availability and entitlements vary.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about", "https://learn.microsoft.com/en-us/purview/purview" ] }, { "id": "purview-ai-governance", "product": "Purview", "area": "Data security posture", "feature": "AI data governance and evidence", "capabilities": [ "Monitor supported AI use", "Apply audit and retention controls", "Review sensitive AI communications" ], "useCase": "Give management evidence that staff use approved AI within defined information boundaries.", "service": "compliance", "deliverables": [ "AI governance control matrix", "AI activity review report" ], "buyer": "Business owner; compliance lead", "licensing": "Coverage is app-specific; current DSPM replaces DSPM for AI (classic).", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/ai-microsoft-purview", "https://learn.microsoft.com/en-us/purview/dspm-for-ai" ] }, { "id": "purview-data-map", "product": "Purview", "area": "Data governance", "feature": "Data estate discovery and scanning", "capabilities": [ "Register and scan supported data sources", "Capture technical metadata and classifications", "Monitor scanning and metadata capacity" ], "useCase": "Locate important data across databases, cloud storage and existing systems.", "service": "engineering", "deliverables": [ "Data-source inventory", "Scheduled scanning configuration" ], "buyer": "Data owner; IT manager", "licensing": "Data Map scanning and capacity can incur consumption charges; source coverage varies.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/data-map" ] }, { "id": "purview-catalog", "product": "Purview", "area": "Data governance", "feature": "Unified Catalog and business data products", "capabilities": [ "Organize governance domains", "Publish curated data products", "Assign data owners and business context" ], "useCase": "Help teams find trustworthy information for reporting and automation.", "service": "compliance", "deliverables": [ "Initial business data catalog", "Data ownership and stewardship register" ], "buyer": "Finance leader; data officer", "licensing": "Enterprise governance setup and billing prerequisites apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/unified-catalog" ] }, { "id": "purview-lineage", "product": "Purview", "area": "Data governance", "feature": "Data lineage and impact analysis", "capabilities": [ "Trace supported source-to-report flows", "Inspect asset and column relationships", "Fill agreed gaps with custom metadata" ], "useCase": "Explain where business figures originate and assess the effect of system changes.", "service": "engineering", "deliverables": [ "Critical-report lineage map", "Documented lineage coverage gaps" ], "buyer": "Finance leader; data engineer", "licensing": "Connector-specific lineage coverage; current and classic experiences differ.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage-user-guide", "https://learn.microsoft.com/en-us/purview/data-map" ] }, { "id": "purview-data-quality", "product": "Purview", "area": "Data governance", "feature": "Data quality measurement", "capabilities": [ "Profile supported data assets", "Configure quality rules", "Track asset, product and domain scores" ], "useCase": "Identify missing, inconsistent or unreliable data before it feeds reports or AI.", "service": "engineering", "deliverables": [ "Data quality rules and baseline", "Owner-assigned remediation backlog" ], "buyer": "Finance leader; operations manager", "licensing": "Supported sources and governance consumption prerequisites apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/unified-catalog-data-quality" ] }, { "id": "purview-data-access", "product": "Purview", "area": "Data governance", "feature": "Governed data access and stewardship", "capabilities": [ "Data-product access request policies", "Business glossary and critical data elements", "Governance health actions and objectives" ], "useCase": "Make data access requests understandable, accountable and aligned to business use.", "service": "compliance", "deliverables": [ "Data access request workflow", "Glossary and stewardship standards" ], "buyer": "Data owner; compliance officer", "licensing": "Verify source-level enforcement and billing; catalog approval alone is not universal access control.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/unified-catalog" ] }, { "id": "exchange-01", "product": "Exchange", "area": "Mailboxes & collaboration", "feature": "User mailboxes and lifecycle", "capabilities": [ "Mailbox provisioning", "Aliases", "Quotas", "Automatic replies" ], "useCase": "Give employees a managed business inbox from joining through role changes.", "service": "support", "deliverables": [ "Mailbox configuration baseline", "Joiner and mover checklist" ], "buyer": "Business owners and IT", "licensing": "Exchange Online entitlement required; client and plan limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/manage-user-mailboxes" ] }, { "id": "exchange-02", "product": "Exchange", "area": "Mailboxes & collaboration", "feature": "Shared departmental inboxes", "capabilities": [ "Shared mailboxes", "Full Access", "Send As", "Shared calendar" ], "useCase": "Let a clinic reception or contractor office handle one team address with named access.", "service": "support", "deliverables": [ "Configured shared inbox", "Ownership and access register" ], "buyer": "Operations managers", "licensing": "Licensed users need delegated access; storage, archiving, and hold can add license requirements.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/collaboration-exo/shared-mailboxes" ] }, { "id": "exchange-03", "product": "Exchange", "area": "Mailboxes & collaboration", "feature": "Executive mailbox delegation", "capabilities": [ "Send on behalf", "Read and manage", "Separate sending rights" ], "useCase": "Allow authorized assistants to support executives without sharing passwords.", "service": "support", "deliverables": [ "Delegation matrix", "Tested access and removal procedure" ], "buyer": "Executives and office managers", "licensing": "Exchange Online entitlement required; client and plan limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/manage-user-mailboxes" ] }, { "id": "exchange-04", "product": "Exchange", "area": "Mailboxes & collaboration", "feature": "Room and equipment booking", "capabilities": [ "Room mailboxes", "Equipment mailboxes", "Booking delegates", "Booking limits" ], "useCase": "Prevent conflicting reservations for church rooms, clinic spaces, and shared equipment.", "service": "support", "deliverables": [ "Resource calendar setup", "Booking rules and staff guide" ], "buyer": "Facilities and operations", "licensing": "Exchange Online entitlement required; client and plan limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-resource-mailboxes" ] }, { "id": "exchange-05", "product": "Exchange", "area": "Mailboxes & collaboration", "feature": "Calendar and contact collaboration", "capabilities": [ "Shared calendars", "Free/busy information", "Contact access" ], "useCase": "Coordinate appointments and team availability using agreed sharing boundaries.", "service": "support", "deliverables": [ "Sharing configuration", "Staff scheduling guide" ], "buyer": "Professional service teams", "licensing": "Exchange Online entitlement required; client and plan limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-service-description" ] }, { "id": "exchange-06", "product": "Exchange", "area": "Mailboxes & collaboration", "feature": "Distribution and recipient groups", "capabilities": [ "Distribution groups", "Membership management", "Delivery restrictions", "Moderation" ], "useCase": "Send announcements to the right staff group with controlled membership.", "service": "support", "deliverables": [ "Group structure and owners", "Membership review procedure" ], "buyer": "HR and operations", "licensing": "Exchange Online entitlement required; client and plan limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-distribution-groups/manage-distribution-groups" ] }, { "id": "exchange-07", "product": "Exchange", "area": "Mailboxes & collaboration", "feature": "Address book organization", "capabilities": [ "Global address lists", "Address book policies", "Directory segmentation" ], "useCase": "Give staff a relevant directory across locations and business units.", "service": "support", "deliverables": [ "Address book design", "Recipient visibility review" ], "buyer": "Multi-location businesses", "licensing": "Availability and administration rights vary by subscription.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/address-books/address-book-policies/address-book-policies" ] }, { "id": "exchange-08", "product": "Exchange", "area": "Mailboxes & collaboration", "feature": "Outlook and mobile access", "capabilities": [ "Outlook connectivity", "Web access", "Mobile mailbox access" ], "useCase": "Resolve everyday email access issues for remote and mobile workers.", "service": "support", "deliverables": [ "Client configuration and troubleshooting", "Access support runbook" ], "buyer": "All businesses", "licensing": "Desktop Outlook rights and device controls are separate from a mailbox-only subscription.", "sourceUrls": [ "https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-service-description" ] }, { "id": "exchange-09", "product": "Exchange", "area": "Mail flow & delivery", "feature": "Business domain configuration", "capabilities": [ "Accepted domains", "Authoritative routing", "Internal relay domains" ], "useCase": "Align business email addresses and routing with company domains.", "service": "engineering", "deliverables": [ "Domain and DNS change plan", "Mail-flow acceptance tests" ], "buyer": "New or expanding businesses", "licensing": "Exchange Online entitlement required; client and plan limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains" ] }, { "id": "exchange-10", "product": "Exchange", "area": "Mail flow & delivery", "feature": "Connectors and transport security", "capabilities": [ "Inbound connectors", "Outbound connectors", "TLS requirements", "Scoped routing" ], "useCase": "Connect business systems and mail platforms with explicit trust boundaries.", "service": "engineering", "deliverables": [ "Connector and certificate configuration", "Routing and TLS validation" ], "buyer": "IT and operations", "licensing": "Exchange Online entitlement required; client and plan limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/use-connectors-to-configure-mail-flow" ] }, { "id": "exchange-11", "product": "Exchange", "area": "Mail flow & delivery", "feature": "Application and device email", "capabilities": [ "Authenticated SMTP options", "SMTP relay", "Device sending design" ], "useCase": "Keep scanners, line-of-business systems, and notifications sending through supported methods.", "service": "engineering", "deliverables": [ "Sender inventory and selected method", "Tested relay and credential controls" ], "buyer": "Clinics, contractors, and offices", "licensing": "Sending methods have different authentication, network, and licensing requirements; avoid legacy assumptions.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365" ] }, { "id": "exchange-12", "product": "Exchange", "area": "Mail flow & delivery", "feature": "Transport policies and routing", "capabilities": [ "Conditions and exceptions", "Disclaimers", "Moderation", "Message handling" ], "useCase": "Apply business email handling rules without relying on each employee to remember them.", "service": "engineering", "deliverables": [ "Tested mail-flow rules", "Exception register and rollback plan" ], "buyer": "Compliance and operations", "licensing": "Exchange Online entitlement required; client and plan limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules" ] }, { "id": "exchange-13", "product": "Exchange", "area": "Mail flow & delivery", "feature": "SPF, DKIM, DMARC and ARC", "capabilities": [ "Authorized sender records", "Cryptographic signing", "Domain alignment", "Trusted forwarding" ], "useCase": "Reduce spoofing of company domains and diagnose legitimate delivery failures.", "service": "engineering", "deliverables": [ "Sending-source inventory", "Validated authentication and enforcement plan" ], "buyer": "Finance teams and business owners", "licensing": "DNS control is required; authentication does not guarantee delivery or prevent every impersonation attack.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-office-365/email-authentication-about" ] }, { "id": "exchange-14", "product": "Exchange", "area": "Mail flow & delivery", "feature": "Message trace and delivery investigation", "capabilities": [ "Trace search", "Delivery status", "Event details", "Report export" ], "useCase": "Explain whether a proposal, invoice, or customer message reached its destination service.", "service": "support", "deliverables": [ "Delivery investigation report", "Remediation actions and evidence" ], "buyer": "Sales, finance, and support", "licensing": "Trace retention and search limits apply; delivery status is not proof a human read the message.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/monitoring/trace-an-email-message/message-trace-modern-eac" ] }, { "id": "exchange-16", "product": "Exchange", "area": "Protection & retention", "feature": "Online archiving", "capabilities": [ "Archive enablement", "Archive access", "Storage management" ], "useCase": "Move aging business correspondence into a governed archive.", "service": "compliance", "deliverables": [ "Archive rollout plan", "Retention and storage review" ], "buyer": "Law and accounting firms", "licensing": "Archive and expanded capacity rights depend on licenses; an archive is not a separate backup.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/enable-archive-mailboxes" ] }, { "id": "exchange-17", "product": "Exchange", "area": "Protection & retention", "feature": "Mailbox recovery and offboarding", "capabilities": [ "Soft-deleted mailbox recovery", "Deleted mailbox states", "Lifecycle controls" ], "useCase": "Recover eligible deleted mailboxes and preserve needed business records when staff leave.", "service": "support", "deliverables": [ "Offboarding and recovery runbook", "Validated recovery checks" ], "buyer": "HR and office managers", "licensing": "Recovery windows, retention, and license state matter; recovery is not guaranteed after applicable limits.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/delete-or-restore-mailboxes" ] }, { "id": "exchange-18", "product": "Exchange", "area": "Protection & retention", "feature": "Mailbox preservation and hold", "capabilities": [ "Litigation hold", "Archive settings", "Retention policies" ], "useCase": "Preserve specified correspondence under an approved legal or records requirement.", "service": "compliance", "deliverables": [ "Authorized preservation configuration", "Hold ownership and review register" ], "buyer": "Legal and compliance", "licensing": "Hold eligibility depends on licensing; legal scope and release decisions remain with the client.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/manage-user-mailboxes" ] }, { "id": "exchange-19", "product": "Exchange", "area": "Migration & administration", "feature": "Email migration to Microsoft 365", "capabilities": [ "Migration batches", "IMAP migration", "Mailbox cutover", "Validation" ], "useCase": "Move business mail into Microsoft 365 with a controlled transition.", "service": "engineering", "deliverables": [ "Migration plan and pilot", "Cutover validation and handover" ], "buyer": "Organizations changing email platforms", "licensing": "Migration paths differ; IMAP moves mail, not all contacts or calendars. Target licensing required.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/mailbox-migration/mailbox-migration" ] }, { "id": "exchange-20", "product": "Exchange", "area": "Migration & administration", "feature": "Hybrid and cross-tenant migration planning", "capabilities": [ "Hybrid coexistence", "Staged moves", "Cross-tenant mailbox mapping" ], "useCase": "Support a phased cloud move or business reorganization.", "service": "engineering", "deliverables": [ "Identity and routing dependency assessment", "Migration sequencing and rollback plan" ], "buyer": "Businesses with existing Exchange estates", "licensing": "Source versions, hybrid licensing, and cross-tenant migration entitlements require separate validation.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/mailbox-migration/mailbox-migration" ] }, { "id": "exchange-21", "product": "Exchange", "area": "Migration & administration", "feature": "Application mailbox access controls", "capabilities": [ "Application RBAC", "Management scopes", "Least-privilege access" ], "useCase": "Limit an integration or automation to the mailboxes it needs.", "service": "engineering", "deliverables": [ "Application permissions inventory", "Scoped access tests" ], "buyer": "Businesses using CRM and workflow tools", "licensing": "App registration and scoped authorization required; other granted permissions must also be reviewed.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac" ] }, { "id": "exchange-22", "product": "Exchange", "area": "Migration & administration", "feature": "Exchange administrator roles", "capabilities": [ "Role groups", "Management roles", "Assignment policies" ], "useCase": "Give support staff the access they need without broad administrative privileges.", "service": "managed", "deliverables": [ "Role matrix and assignments", "Periodic privileged access review" ], "buyer": "IT managers", "licensing": "Exchange Online entitlement required; client and plan limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/permissions-exo/permissions-exo" ] }, { "id": "exchange-23", "product": "Exchange", "area": "Migration & administration", "feature": "EWS integration modernization", "capabilities": [ "EWS dependency discovery", "Microsoft Graph migration planning", "API regression testing" ], "useCase": "Replace aging email integrations before retirement disrupts business workflows.", "service": "engineering", "deliverables": [ "Application dependency inventory", "Graph migration and validation plan" ], "buyer": "Businesses with custom applications", "licensing": "Exchange Online EWS is in phased retirement; API coverage and current Microsoft timelines must be checked per integration.", "sourceUrls": [ "https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-ews-exchange-online" ] }, { "id": "exchange-24", "product": "Exchange", "area": "Protection & retention", "feature": "Microsoft 365 Backup for Exchange", "capabilities": [ "Mailbox protection policies", "Point-in-time restoration", "Restore operations" ], "useCase": "Add a separately scoped recovery layer for critical business mail.", "service": "managed", "deliverables": [ "Backup scope and protection policy", "Documented recovery exercise" ], "buyer": "Businesses with recovery requirements", "licensing": "Microsoft 365 Backup is a separately billed service; coverage and restore constraints apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-365/backup/backup-overview" ] }, { "id": "sharepoint-01", "product": "SharePoint", "area": "Sites & knowledge", "feature": "Team sites and project workspaces", "capabilities": [ "Team sites", "Document libraries", "Shared project content" ], "useCase": "Give contractor or client-service teams one governed workspace for each engagement.", "service": "support", "deliverables": [ "Workspace template and owners", "Access and collaboration guide" ], "buyer": "Project teams", "licensing": "SharePoint Online entitlement required; storage and access limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/planning-hub-sites" ] }, { "id": "sharepoint-02", "product": "SharePoint", "area": "Sites & knowledge", "feature": "Communication sites and intranets", "capabilities": [ "Modern pages", "News", "Navigation", "Reusable web parts" ], "useCase": "Publish policies, staff information, and operational updates in one place.", "service": "support", "deliverables": [ "Branded intranet structure", "Publishing responsibilities and training" ], "buyer": "HR and operations", "licensing": "SharePoint Online entitlement required; storage and access limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/planning-hub-sites" ] }, { "id": "sharepoint-03", "product": "SharePoint", "area": "Sites & knowledge", "feature": "Hub sites", "capabilities": [ "Connected navigation", "Related news", "Shared discovery" ], "useCase": "Connect branches or departments without merging their access permissions.", "service": "support", "deliverables": [ "Hub architecture", "Navigation and association plan" ], "buyer": "Multi-location organizations", "licensing": "SharePoint Online entitlement required; storage and access limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/planning-hub-sites" ] }, { "id": "sharepoint-04", "product": "SharePoint", "area": "Documents & workflow", "feature": "Document libraries and collaboration", "capabilities": [ "File organization", "Office coauthoring", "Browser editing", "OneDrive sync integration" ], "useCase": "Replace uncontrolled document copies with shared working files.", "service": "support", "deliverables": [ "Library structure", "Coauthoring and sync rollout" ], "buyer": "Professional firms", "licensing": "SharePoint entitlement and appropriate Office client rights required.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/introduction" ] }, { "id": "sharepoint-05", "product": "SharePoint", "area": "Documents & workflow", "feature": "Version history and restoration", "capabilities": [ "File versions", "Version limits", "Version restoration" ], "useCase": "Recover earlier work and manage the storage used by document history.", "service": "managed", "deliverables": [ "Version policy", "Restore guide and validation" ], "buyer": "Document-heavy businesses", "licensing": "Version retention is policy-dependent and not equivalent to independent backup.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/version-overview" ] }, { "id": "sharepoint-06", "product": "SharePoint", "area": "Documents & workflow", "feature": "Metadata and taxonomy", "capabilities": [ "Managed metadata", "Term sets", "Library columns", "Metadata views" ], "useCase": "Find contracts, tax files, or project records by business meaning.", "service": "support", "deliverables": [ "Metadata taxonomy", "Library columns and navigation" ], "buyer": "Law firms, CPAs, and contractors", "licensing": "SharePoint Online entitlement required; storage and access limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/managed-metadata" ] }, { "id": "sharepoint-07", "product": "SharePoint", "area": "Documents & workflow", "feature": "Standardized document types", "capabilities": [ "Content types", "Reusable metadata", "Document classification" ], "useCase": "Apply consistent information fields across repeated business documents.", "service": "support", "deliverables": [ "Content type design", "Owner and classification guidance" ], "buyer": "Records and operations teams", "licensing": "SharePoint Online entitlement required; storage and access limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/managed-metadata" ] }, { "id": "sharepoint-08", "product": "SharePoint", "area": "Documents & workflow", "feature": "Lists and operational registers", "capabilities": [ "Lists", "Columns", "Views", "Item tracking" ], "useCase": "Track equipment, requests, obligations, or project actions in a shared register.", "service": "automation", "deliverables": [ "Configured business register", "Owner workflow and access model" ], "buyer": "Clinics, NGOs, and trades", "licensing": "SharePoint Online entitlement required; storage and access limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/office365/servicedescriptions/sharepoint-online-service-description/sharepoint-online-service-description" ] }, { "id": "sharepoint-09", "product": "SharePoint", "area": "Documents & workflow", "feature": "Approvals and notifications", "capabilities": [ "Power Automate triggers", "SharePoint actions", "Approval workflows" ], "useCase": "Route purchase requests or document reviews to the right approver.", "service": "automation", "deliverables": [ "Approval flow and exceptions", "Monitoring and support handover" ], "buyer": "Finance and operations", "licensing": "Power Automate licensing depends on connectors and flow design; SharePoint alone does not include every automation right.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/dev/business-apps/power-automate/sharepoint-connector-actions-triggers" ] }, { "id": "sharepoint-10", "product": "SharePoint", "area": "Sites & knowledge", "feature": "Search and information discovery", "capabilities": [ "Search settings", "Search experience", "Content discoverability" ], "useCase": "Help employees find approved procedures and business records faster.", "service": "support", "deliverables": [ "Search configuration", "Findability test and content cleanup" ], "buyer": "All organizations", "licensing": "SharePoint Online entitlement required; storage and access limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/manage-search-center" ] }, { "id": "sharepoint-11", "product": "SharePoint", "area": "Security & governance", "feature": "Site permissions and ownership", "capabilities": [ "Site owners and members", "Permission inheritance", "Group-based access" ], "useCase": "Give each team an accountable owner and appropriate document access.", "service": "engineering", "deliverables": [ "Permission model", "Access remediation and owner guide" ], "buyer": "Business and IT leaders", "licensing": "SharePoint Online entitlement required; storage and access limits apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/modern-experience-sharing-permissions" ] }, { "id": "sharepoint-12", "product": "SharePoint", "area": "Security & governance", "feature": "Guest and external sharing", "capabilities": [ "Organization sharing settings", "Site sharing controls", "Link choices", "Guest access" ], "useCase": "Share client or supplier documents within explicit boundaries.", "service": "engineering", "deliverables": [ "External sharing baseline", "Guest lifecycle and review process" ], "buyer": "Law firms, contractors, and nonprofits", "licensing": "Tenant and site settings interact; guest identity and other Microsoft controls may add prerequisites.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/external-sharing-overview" ] }, { "id": "sharepoint-13", "product": "SharePoint", "area": "Security & governance", "feature": "Unmanaged device restrictions", "capabilities": [ "Browser-only access", "Download limitations", "Device access conditions" ], "useCase": "Limit exposure when staff access sensitive documents from personal devices.", "service": "engineering", "deliverables": [ "Device access design", "Pilot and exception validation" ], "buyer": "Clinics and professional firms", "licensing": "Microsoft Entra Conditional Access licensing and device posture dependencies apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices" ] }, { "id": "sharepoint-14", "product": "SharePoint", "area": "Security & governance", "feature": "Oversharing assessment", "capabilities": [ "Data access governance reports", "Permission exposure review", "Site access review" ], "useCase": "Find broadly accessible content before wider collaboration or Copilot adoption.", "service": "compliance", "deliverables": [ "Oversharing findings", "Prioritized owner-led cleanup" ], "buyer": "Business and compliance leaders", "licensing": "Requires eligible SharePoint Advanced Management features; Copilot inclusion and standalone add-on rights differ.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/advanced-management" ] }, { "id": "sharepoint-15", "product": "SharePoint", "area": "Security & governance", "feature": "Restricted content discovery", "capabilities": [ "Site discovery restrictions", "Copilot discovery boundaries" ], "useCase": "Reduce discovery of high-risk sites while permissions are being remediated.", "service": "engineering", "deliverables": [ "Discovery restriction configuration", "Permissions remediation plan" ], "buyer": "Organizations adopting Copilot", "licensing": "Requires eligible SAM features; discovery restrictions do not remove existing permissions.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery" ] }, { "id": "sharepoint-16", "product": "SharePoint", "area": "Security & governance", "feature": "Site lifecycle management", "capabilities": [ "Inactive site policies", "Owner accountability", "Site attestation" ], "useCase": "Reduce abandoned workspaces and keep owners responsible for content.", "service": "managed", "deliverables": [ "Lifecycle policy", "Owner review and escalation routine" ], "buyer": "Growing organizations", "licensing": "Requires eligible SharePoint Advanced Management features; Copilot inclusion and standalone add-on rights differ.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/site-lifecycle-management" ] }, { "id": "sharepoint-17", "product": "SharePoint", "area": "Security & governance", "feature": "Advanced access and download controls", "capabilities": [ "Restricted site access", "Download policies", "Sensitive site controls" ], "useCase": "Add stronger access boundaries around high-value content.", "service": "engineering", "deliverables": [ "Sensitive-site control design", "Access and download tests" ], "buyer": "Law firms and leadership teams", "licensing": "Requires eligible SharePoint Advanced Management features; Copilot inclusion and standalone add-on rights differ.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/advanced-management" ] }, { "id": "sharepoint-18", "product": "SharePoint", "area": "Security & governance", "feature": "Administrative change oversight", "capabilities": [ "Change history", "Site property changes", "Governance reporting" ], "useCase": "Explain configuration changes and support operational accountability.", "service": "managed", "deliverables": [ "Change review report", "Administrative change procedure" ], "buyer": "IT and compliance", "licensing": "Requires eligible SharePoint Advanced Management features; Copilot inclusion and standalone add-on rights differ.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/advanced-management" ] }, { "id": "sharepoint-19", "product": "SharePoint", "area": "Security & governance", "feature": "Site catalog and governance organization", "capabilities": [ "Site categories", "Department grouping", "Policy-oriented site organization" ], "useCase": "Apply governance to meaningful groups of sites as the estate grows.", "service": "managed", "deliverables": [ "Site classification model", "Governance ownership register" ], "buyer": "Multi-department organizations", "licensing": "Requires eligible SharePoint Advanced Management features; Copilot inclusion and standalone add-on rights differ.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/catalog-management" ] }, { "id": "sharepoint-20", "product": "SharePoint", "area": "Documents & workflow", "feature": "Document OCR", "capabilities": [ "Image text recognition", "Searchable extracted text", "Supported PDF processing" ], "useCase": "Make scanned supplier or case documents easier to find.", "service": "automation", "deliverables": [ "OCR-enabled libraries", "Extraction quality sample checks" ], "buyer": "Law firms, CPAs, and contractors", "licensing": "Document processing billing, supported file types, region, and tenant configuration must be confirmed.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-365/documentprocessing/ocr-overview" ] }, { "id": "sharepoint-21", "product": "SharePoint", "area": "Documents & workflow", "feature": "AI metadata extraction and autofill", "capabilities": [ "Autofill columns", "Document summaries", "Metadata extraction" ], "useCase": "Reduce manual tagging of business documents.", "service": "automation", "deliverables": [ "Configured extraction columns", "Validation and exception process" ], "buyer": "Document-heavy teams", "licensing": "Document processing billing, supported file types, region, and tenant configuration must be confirmed.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-365/syntex/autofill-overview" ] }, { "id": "sharepoint-22", "product": "SharePoint", "area": "Documents & workflow", "feature": "Structured document capture", "capabilities": [ "Structured models", "Freeform models", "Key-value and table extraction" ], "useCase": "Capture incoming form data for review before downstream processing.", "service": "automation", "deliverables": [ "Document capture pilot", "Human validation workflow" ], "buyer": "Operations and finance", "licensing": "Document processing billing, supported file types, region, and tenant configuration must be confirmed. AI Builder dependencies may apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-365/documentprocessing/form-processing-overview" ] }, { "id": "sharepoint-23", "product": "SharePoint", "area": "Documents & workflow", "feature": "Prebuilt invoice and receipt extraction", "capabilities": [ "Prebuilt processing models", "Extracted fields", "Library content types" ], "useCase": "Prepare invoice or receipt information for finance review.", "service": "automation", "deliverables": [ "Sample-based extraction setup", "Accuracy and exception report" ], "buyer": "CPA offices and finance teams", "licensing": "Document processing billing, supported file types, region, and tenant configuration must be confirmed.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-365/documentprocessing/prebuilt-overview" ] }, { "id": "sharepoint-24", "product": "SharePoint", "area": "Documents & workflow", "feature": "Document translation and assembly", "capabilities": [ "Document translation", "Content assembly", "Document processing services" ], "useCase": "Create repeatable documents or translated working copies from approved source material.", "service": "automation", "deliverables": [ "Scoped document workflow", "Review and publishing checklist" ], "buyer": "Community organizations and operations", "licensing": "Document processing billing, supported file types, region, and tenant configuration must be confirmed.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-365/documentprocessing/syntex-overview" ] }, { "id": "sharepoint-25", "product": "SharePoint", "area": "Documents & workflow", "feature": "Electronic signature workflows", "capabilities": [ "Signature requests", "External signing", "Completed document storage" ], "useCase": "Move selected agreements from manual emailing into a traceable signing process.", "service": "automation", "deliverables": [ "Signing workflow setup", "Storage and access configuration" ], "buyer": "Professional firms and contractors", "licensing": "Microsoft eSignature billing, availability, identity, and document eligibility apply; confirm legal suitability.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-365/documentprocessing/esignature-overview" ] }, { "id": "sharepoint-26", "product": "SharePoint", "area": "Migration & operations", "feature": "File migration to SharePoint", "capabilities": [ "Migration Manager", "File-share assessment", "Migration tasks" ], "useCase": "Move business files into governed cloud libraries.", "service": "engineering", "deliverables": [ "Migration assessment and mapping", "Pilot and migration validation" ], "buyer": "Businesses replacing file servers", "licensing": "Source access, file limits, permissions, and destination capacity require validation.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepointmigration/mm-get-started" ] }, { "id": "sharepoint-27", "product": "SharePoint", "area": "Migration & operations", "feature": "Teams-connected file governance", "capabilities": [ "Team sites", "Private and shared channel sites", "Membership-linked permissions" ], "useCase": "Keep Teams file access aligned with the actual channel and membership structure.", "service": "managed", "deliverables": [ "Teams-to-site inventory", "Permission and ownership review" ], "buyer": "Teams-based organizations", "licensing": "Teams and SharePoint rights and channel-specific behavior apply.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/teams-connected-sites" ] }, { "id": "sharepoint-28", "product": "SharePoint", "area": "Migration & operations", "feature": "SharePoint backup and recovery", "capabilities": [ "Site protection", "Point-in-time restores", "Recovery administration" ], "useCase": "Add a separately scoped recovery service for critical content.", "service": "managed", "deliverables": [ "Protection scope", "Recovery exercise and runbook" ], "buyer": "Organizations with critical files", "licensing": "Microsoft 365 Backup is separately billed; retention and restore capabilities differ from native recycle bins.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-365/backup/backup-overview" ] }, { "id": "sharepoint-29", "product": "SharePoint", "area": "Migration & operations", "feature": "Modern SharePoint extensions", "capabilities": [ "SPFx web parts", "Supported extensions", "Microsoft 365 integration" ], "useCase": "Build a focused staff tool within the existing intranet.", "service": "engineering", "deliverables": [ "Scoped extension implementation", "Deployment and maintenance guide" ], "buyer": "Businesses with specific workflow gaps", "licensing": "Development, app permissions, deployment approval, and connected services are separately scoped.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/dev/spfx/sharepoint-framework-overview" ] }, { "id": "sharepoint-30", "product": "SharePoint", "area": "Migration & operations", "feature": "Legacy workflow and Add-In replacement", "capabilities": [ "Retired Add-In assessment", "Classic workflow migration", "Power Automate and SPFx alternatives" ], "useCase": "Replace retired SharePoint customizations that interrupt business processes.", "service": "engineering", "deliverables": [ "Legacy dependency inventory", "Replacement and migration plan" ], "buyer": "Organizations with older SharePoint solutions", "licensing": "SharePoint Online Add-Ins and classic 2013 workflows reached retirement in April 2026; assess each affected solution.", "sourceUrls": [ "https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins/retirement-announcement-for-add-ins", "https://learn.microsoft.com/en-us/sharepoint/dev/general-development/get-started-with-workflows-in-sharepoint" ] }, { "id": "copilot-chat", "product": "Copilot", "area": "Copilot Chat", "feature": "Work-account AI chat", "capabilities": [ "Web-grounded answers", "Supplied-file summarization", "Drafting and brainstorming" ], "useCase": "Help a Detroit small business draft customer messages and summarize approved documents.", "service": "automation", "deliverables": [ "Role-specific prompt library", "Safe-use training session" ], "buyer": "Small business owner", "licensing": "Eligible work subscription and Entra sign-in; baseline chat is not unrestricted access to all company data.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-overview" ] }, { "id": "copilot-work-grounding", "product": "Copilot", "area": "Microsoft 365 Copilot", "feature": "Permission-aware work context", "capabilities": [ "Microsoft Graph grounding", "Email, file and meeting context", "References to accessible sources" ], "useCase": "Help managers prepare client updates from information they already have permission to access.", "service": "automation", "deliverables": [ "Work-grounding readiness report", "Validated executive briefing workflow" ], "buyer": "Business operations manager", "licensing": "Paid Microsoft 365 Copilot entitlement for full work grounding; existing excessive permissions remain a risk.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-overview" ] }, { "id": "copilot-search", "product": "Copilot", "area": "Microsoft 365 Copilot", "feature": "Enterprise search and connected knowledge", "capabilities": [ "Copilot Search", "Microsoft 365 content discovery", "Connected external sources" ], "useCase": "Help a law firm find approved precedents and project material across its document estate.", "service": "engineering", "deliverables": [ "Search and connector configuration", "Search relevance acceptance tests" ], "buyer": "Knowledge or IT manager", "licensing": "Copilot entitlement and supported connectors; source permissions and indexing configuration determine results.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-search" ] }, { "id": "copilot-word", "product": "Copilot", "area": "Microsoft 365 Copilot apps", "feature": "Word drafting and document assistance", "capabilities": [ "Source-based first drafts", "Rewriting and summarization", "Document question answering" ], "useCase": "Create first drafts of proposals, policies and engagement letters for staff review.", "service": "automation", "deliverables": [ "Approved document templates", "Draft-to-review workflow" ], "buyer": "Law firm or NGO manager", "licensing": "App entitlement and release channel determine access; human review remains required for legal and factual accuracy.", "sourceUrls": [ "https://support.microsoft.com/en-us/word/copilot/draft-and-add-content-with-copilot-in-word" ] }, { "id": "copilot-excel", "product": "Copilot", "area": "Microsoft 365 Copilot apps", "feature": "Excel analysis and spreadsheet assistance", "capabilities": [ "Formula generation and explanation", "Charts and PivotTables", "Trends, anomalies and text analysis" ], "useCase": "Help a CPA or contractor review job margins and prepare management reports.", "service": "automation", "deliverables": [ "Validated reporting workbook", "Reconciliation and review checklist" ], "buyer": "Finance or operations lead", "licensing": "Eligible Excel/Copilot experience; advanced editing varies by entitlement; verify formulas and underlying data.", "sourceUrls": [ "https://support.microsoft.com/en-us/excel/copilot/data-insights-with-copilot-in-excel" ] }, { "id": "copilot-powerpoint", "product": "Copilot", "area": "Microsoft 365 Copilot apps", "feature": "PowerPoint presentation creation", "capabilities": [ "Prompt-based drafts", "Presentations from source material", "Slide refinement" ], "useCase": "Help an NGO prepare board updates or a contractor prepare project presentations.", "service": "automation", "deliverables": [ "Branded presentation workflow", "Staff review guide" ], "buyer": "Business development or NGO lead", "licensing": "Eligible PowerPoint/Copilot experience; file, template and platform restrictions apply.", "sourceUrls": [ "https://support.microsoft.com/en-us/powerpoint/copilot/create-a-new-presentation-with-copilot-in-powerpoint" ] }, { "id": "copilot-outlook", "product": "Copilot", "area": "Microsoft 365 Copilot apps", "feature": "Outlook email and meeting preparation", "capabilities": [ "Thread summaries", "Draft replies", "Inbox and calendar assistance" ], "useCase": "Help a busy clinic administrator or attorney prepare replies and meeting agendas.", "service": "support", "deliverables": [ "Mailbox productivity configuration", "Client correspondence prompt pack" ], "buyer": "Office administrator", "licensing": "Baseline Outlook context and paid enterprise grounding differ; supported account and tenant policy required.", "sourceUrls": [ "https://support.microsoft.com/en-us/microsoft-365-copilot/how-copilot-chat-works-in-microsoft-365-apps" ] }, { "id": "copilot-teams", "product": "Copilot", "area": "Microsoft 365 Copilot apps", "feature": "Teams meeting intelligence", "capabilities": [ "Discussion summaries", "Questions about meeting content", "Action-item drafting" ], "useCase": "Turn client and project meetings into reviewed decisions and assigned follow-up work.", "service": "automation", "deliverables": [ "Meeting policy configuration", "Minutes and actions workflow" ], "buyer": "Project or practice manager", "licensing": "Eligible Teams/Copilot access; post-meeting spoken-content review requires a retained transcript and permission.", "sourceUrls": [ "https://support.microsoft.com/en-us/teams/copilot/catch-up-on-meetings-with-microsoft-365-copilot-in-teams" ] }, { "id": "copilot-onenote", "product": "Copilot", "area": "Microsoft 365 Copilot apps", "feature": "OneNote notes to plans", "capabilities": [ "Page summarization", "Task-list drafting", "Plans from notes" ], "useCase": "Help an inspector, church administrator or day care manager organize follow-up tasks.", "service": "automation", "deliverables": [ "Structured note templates", "Notes-to-actions training" ], "buyer": "Office or field manager", "licensing": "Eligible OneNote/Copilot experience; supported client and current-page context constrain results.", "sourceUrls": [ "https://support.microsoft.com/en-us/microsoft-365-copilot/how-copilot-chat-works-in-microsoft-365-apps" ] }, { "id": "copilot-pages", "product": "Copilot", "area": "Microsoft 365 Copilot collaboration", "feature": "Copilot Pages and Loop collaboration", "capabilities": [ "Persistent editable AI content", "Shared live pages", "Iterative team drafting" ], "useCase": "Maintain a shared project brief or incident action log with clear owners.", "service": "automation", "deliverables": [ "Shared project page templates", "Permissions and ownership setup" ], "buyer": "Team leader", "licensing": "Pages/Loop must be enabled; storage, sharing and retention policies apply.", "sourceUrls": [ "https://support.microsoft.com/en-us/microsoft-365-copilot/get-started-with-microsoft-365-copilot-pages" ] }, { "id": "copilot-notebooks", "product": "Copilot", "area": "Microsoft 365 Copilot collaboration", "feature": "Copilot Notebooks", "capabilities": [ "Curated reference collections", "Source-focused questions", "Contextual summaries" ], "useCase": "Help a law firm or NGO review a bounded set of matter or grant documents.", "service": "automation", "deliverables": [ "Curated pilot notebook", "Source selection and review guide" ], "buyer": "Research or programme manager", "licensing": "Reference types, quotas and outputs vary by entitlement; notebook access does not override source permissions.", "sourceUrls": [ "https://support.microsoft.com/en-us/microsoft-365-copilot/get-started-with-microsoft-365-copilot-notebooks" ] }, { "id": "copilot-researcher", "product": "Copilot", "area": "Microsoft 365 Copilot agents", "feature": "Researcher", "capabilities": [ "Multistep research", "Work and web synthesis", "Evidence-oriented reports" ], "useCase": "Prepare supplier, market or grant research for a decision-maker to verify.", "service": "automation", "deliverables": [ "Research briefing workflow", "Source validation checklist" ], "buyer": "Executive or procurement lead", "licensing": "Eligible Copilot access, usage limits and administrator policy apply; review source accuracy before decisions.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-365/copilot/faq-researcher" ] }, { "id": "copilot-analyst", "product": "Copilot", "area": "Microsoft 365 Copilot agents", "feature": "Analyst", "capabilities": [ "Complex data exploration", "Analytical reasoning", "Report insights" ], "useCase": "Help operations teams examine service demand and recurring revenue patterns.", "service": "automation", "deliverables": [ "Analysis pilot with sample data", "Validated management report" ], "buyer": "Finance or operations lead", "licensing": "Eligible Copilot entitlement and agent availability; data quality and analyst validation remain necessary.", "sourceUrls": [ "https://learn.microsoft.com/en-us/training/modules/phase-two-onboard/" ] }, { "id": "copilot-agent-builder", "product": "Copilot", "area": "Microsoft 365 Copilot agents", "feature": "Scoped knowledge agents", "capabilities": [ "Custom instructions", "SharePoint and connector knowledge", "Agent testing and sharing" ], "useCase": "Provide staff with answers about approved IT, HR or operating policies.", "service": "automation", "deliverables": [ "Department knowledge agent", "Content ownership register" ], "buyer": "HR or office manager", "licensing": "Knowledge entitlements vary; Agent Builder does not author external-service actions; use Studio for workflows.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/agent-builder" ] }, { "id": "copilot-adoption", "product": "Copilot", "area": "Microsoft 365 Copilot administration", "feature": "Adoption and usage measurement", "capabilities": [ "Active-user metrics", "Prompt activity reporting", "Adoption trend review" ], "useCase": "Measure whether a paid pilot improves selected workflows before adding more licenses.", "service": "managed", "deliverables": [ "Adoption dashboard", "Monthly improvement backlog" ], "buyer": "Owner or IT director", "licensing": "Reporting roles and privacy controls required; activity metrics do not prove time savings or ROI.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-copilot-usage" ] }, { "id": "copilot-readiness", "product": "Copilot", "area": "Microsoft 365 Copilot administration", "feature": "Secure Copilot readiness", "capabilities": [ "Identity and device controls", "Permission review", "Data protection alignment" ], "useCase": "Prepare a law firm or CPA tenant before exposing business content through AI.", "service": "compliance", "deliverables": [ "AI access-risk assessment", "Prioritized remediation plan" ], "buyer": "Compliance or IT lead", "licensing": "Controls depend on underlying Entra, Intune and Purview licenses; Copilot does not repair oversharing automatically.", "sourceUrls": [ "https://learn.microsoft.com/en-us/security/zero-trust/copilots/zero-trust-microsoft-365-copilot" ] }, { "id": "copilot-studio-knowledge", "product": "Copilot", "area": "Copilot Studio", "feature": "Business knowledge assistants", "capabilities": [ "SharePoint and Dataverse grounding", "Document and website sources", "Citations and fallback behaviour" ], "useCase": "Answer staff questions from an approved operations manual instead of repeated email queries.", "service": "automation", "deliverables": [ "Authenticated knowledge assistant", "Content refresh procedure" ], "buyer": "Operations or service manager", "licensing": "Studio capacity and supported source configuration required; user-authenticated knowledge respects access rights.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-copilot-studio/knowledge-copilot-studio" ] }, { "id": "copilot-studio-orchestration", "product": "Copilot", "area": "Copilot Studio", "feature": "Topics and generative orchestration", "capabilities": [ "Guided conversation topics", "Tool and knowledge selection", "Multistep task routing" ], "useCase": "Guide customers through intake and route staff requests to the correct process.", "service": "automation", "deliverables": [ "Intake and routing agent", "Escalation and exception paths" ], "buyer": "Customer service manager", "licensing": "Harness and orchestration mode determine support; production workflows need bounded action permissions and validation.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-generative-actions" ] }, { "id": "copilot-studio-connectors", "product": "Copilot", "area": "Copilot Studio", "feature": "Business system integration", "capabilities": [ "Prebuilt and custom connectors", "Tools that retrieve or update records", "Cross-system process integration" ], "useCase": "Create a service request or retrieve job status without staff re-entering data.", "service": "engineering", "deliverables": [ "Scoped system connector", "Integration error-handling runbook" ], "buyer": "IT or operations manager", "licensing": "Connected system licenses, API access and connector eligibility are separate prerequisites.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-copilot-studio/fundamentals-what-is-copilot-studio" ] }, { "id": "copilot-studio-mcp", "product": "Copilot", "area": "Copilot Studio", "feature": "MCP tool integration", "capabilities": [ "Connect existing MCP servers", "OAuth or API-key authentication", "Reusable tools and resources" ], "useCase": "Expose approved internal system functions to a controlled business agent.", "service": "engineering", "deliverables": [ "Authenticated MCP connection", "Tool permissions and acceptance tests" ], "buyer": "Application or IT lead", "licensing": "Supported transport and harness required; each exposed tool needs explicit scope and server security review.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-add-existing-server-to-agent" ] }, { "id": "copilot-studio-flows", "product": "Copilot", "area": "Copilot Studio", "feature": "Agent flows and approval processes", "capabilities": [ "Repeatable action sequences", "Scheduled or agent-triggered runs", "Human review steps" ], "useCase": "Automate invoice intake, review routing or employee onboarding with approval checkpoints.", "service": "automation", "deliverables": [ "Configured workflow with approvals", "Exception queue and operator guide" ], "buyer": "Finance or HR manager", "licensing": "Flow actions consume capacity; external Power Automate or application rights may also be required.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-copilot-studio/flows-overview" ] }, { "id": "copilot-studio-events", "product": "Copilot", "area": "Copilot Studio", "feature": "Event-driven automation", "capabilities": [ "Event triggers", "Proactive task execution", "Triggered topic or tool calls" ], "useCase": "Start intake checks when a service request arrives and prepare a staff action.", "service": "automation", "deliverables": [ "Bounded event-triggered pilot", "Action audit and recovery procedure" ], "buyer": "Operations manager", "licensing": "Trigger connection identity and permissions govern access; require approval before material external actions.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-copilot-studio/authoring-triggers-about" ] }, { "id": "copilot-studio-channels", "product": "Copilot", "area": "Copilot Studio", "feature": "Employee and customer channels", "capabilities": [ "Teams and Microsoft 365 surfaces", "Website distribution", "Channel-specific publishing" ], "useCase": "Give employees a Teams assistant or customers a website service-intake assistant.", "service": "automation", "deliverables": [ "Production channel deployment", "Channel-specific acceptance checklist" ], "buyer": "Service or IT manager", "licensing": "External/public channels may require standalone Studio capacity; authentication support varies by destination.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-copilot-studio/publication-fundamentals-publish-channels" ] }, { "id": "copilot-studio-handoff", "product": "Copilot", "area": "Copilot Studio", "feature": "Human escalation", "capabilities": [ "Transfer conversation context", "Escalation paths", "Live-agent integration" ], "useCase": "Escalate unresolved IT issues or sensitive client questions to the responsible employee.", "service": "support", "deliverables": [ "Escalation routing configuration", "Handoff operating procedure" ], "buyer": "Service desk manager", "licensing": "Requires a compatible engagement hub or implemented handoff integration; staffing remains a separate service.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-hand-off" ] }, { "id": "copilot-studio-auth", "product": "Copilot", "area": "Copilot Studio", "feature": "Agent authentication and access", "capabilities": [ "Microsoft Entra sign-in", "Single sign-on", "User-context system access" ], "useCase": "Limit employee assistants to authorized records and prevent anonymous access to internal knowledge.", "service": "engineering", "deliverables": [ "Authentication and SSO setup", "Positive and negative access tests" ], "buyer": "IT or security lead", "licensing": "Identity configuration, channel support and backend permissions apply; authentication alone does not authorize every action.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-end-user-authentication" ] }, { "id": "copilot-studio-governance", "product": "Copilot", "area": "Copilot Studio", "feature": "Agent data and publishing controls", "capabilities": [ "Connector data policies", "Knowledge and HTTP restrictions", "Unauthenticated-channel controls" ], "useCase": "Keep sensitive church donor or clinic administrative data out of unapproved integrations.", "service": "compliance", "deliverables": [ "Agent data-policy baseline", "Publishing and exception register" ], "buyer": "Compliance or security lead", "licensing": "Power Platform admin controls required; policy support varies by connector and agent experience.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-copilot-studio/admin-data-loss-prevention" ] }, { "id": "copilot-studio-alm", "product": "Copilot", "area": "Copilot Studio", "feature": "Agent release management", "capabilities": [ "Power Platform solutions", "Separate environments", "Controlled deployments" ], "useCase": "Change a production assistant without disrupting daily customer or staff work.", "service": "engineering", "deliverables": [ "Development-to-production release path", "Rollback and change procedure" ], "buyer": "IT or application owner", "licensing": "Environment, solution and pipeline prerequisites apply; validate dependencies and connection references during deployment.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-copilot-studio/authoring-solutions-overview" ] }, { "id": "copilot-studio-evaluation", "product": "Copilot", "area": "Copilot Studio", "feature": "Agent quality and safety testing", "capabilities": [ "Representative test sets", "Response scoring", "Transcript and tool-use review" ], "useCase": "Check that an assistant answers common questions accurately and escalates unsafe or unsupported requests.", "service": "engineering", "deliverables": [ "Business scenario test suite", "Release acceptance report" ], "buyer": "Business process owner", "licensing": "Evaluation availability differs by harness and rollout; automated grades complement human acceptance testing.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-copilot-studio/analytics-agent-evaluation-intro" ] }, { "id": "copilot-studio-monitoring", "product": "Copilot", "area": "Copilot Studio", "feature": "Managed agent operations", "capabilities": [ "Session outcomes", "Escalation and abandonment trends", "Feedback and transcript analysis" ], "useCase": "Maintain a useful service assistant as questions, documents and business rules change.", "service": "managed", "deliverables": [ "Monthly agent service report", "Prioritized tuning backlog" ], "buyer": "Operations or service manager", "licensing": "Analytics retention, roles and transcript privacy controls apply; monitoring does not remove ownership of content.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-copilot-studio/analytics-overview" ] }, { "id": "copilot-studio-capacity", "product": "Copilot", "area": "Copilot Studio", "feature": "Agent cost and capacity management", "capabilities": [ "Copilot Credit estimation", "Usage-based billing configuration", "Capacity review" ], "useCase": "Control the operating cost of customer-facing automation before increasing traffic.", "service": "managed", "deliverables": [ "Pilot consumption estimate", "Monthly cost and capacity review" ], "buyer": "Business owner or finance lead", "licensing": "Standard-harness Copilot Credits differ from per-user Copilot licenses; other harnesses can use different billing.", "sourceUrls": [ "https://learn.microsoft.com/en-us/microsoft-copilot-studio/billing-licensing" ] }, { "id": "copilot-security-incidents", "product": "Copilot", "area": "Security Copilot", "feature": "Incident investigation assistance", "capabilities": [ "Incident and entity summaries", "Guided response suggestions", "Incident report drafting" ], "useCase": "Help Simba SOC analysts explain a suspected compromise and document approved response actions.", "service": "mdr", "deliverables": [ "Analyst investigation workflow", "Reviewed incident report template" ], "buyer": "Security or IT lead", "licensing": "Security Copilot access and underlying Defender permissions required; assistant outputs remain analyst-reviewed.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-xdr/security-copilot-in-microsoft-365-defender" ] }, { "id": "copilot-security-analysis", "product": "Copilot", "area": "Security Copilot", "feature": "Script and file analysis", "capabilities": [ "Suspicious script explanation", "File context summaries", "Relevant investigation leads" ], "useCase": "Help analysts assess suspicious scripts or attachments before deciding containment steps.", "service": "mdr", "deliverables": [ "Malicious-artifact triage workflow", "Evidence and escalation checklist" ], "buyer": "Security operations lead", "licensing": "Security Copilot and accessible security telemetry required; AI analysis is not a conclusive malware verdict.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-xdr/security-copilot-in-microsoft-365-defender" ] }, { "id": "copilot-security-hunting", "product": "Copilot", "area": "Security Copilot", "feature": "Natural-language threat hunting", "capabilities": [ "KQL query drafting", "Query logic explanation", "Analyst-led query refinement" ], "useCase": "Search endpoint and identity events for activity linked to a current incident.", "service": "mdr", "deliverables": [ "Validated hunting query pack", "Hunt findings report" ], "buyer": "Security operations lead", "licensing": "Requires supported hunting data and permissions; assistant availability can be prerelease or tenant-dependent.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-security-copilot-query-assistant" ] }, { "id": "copilot-security-intel", "product": "Copilot", "area": "Security Copilot", "feature": "Threat intelligence synthesis", "capabilities": [ "Actor and campaign context", "Indicator enrichment", "Vulnerability relevance review" ], "useCase": "Help clients prioritize threats that affect their systems and business sector.", "service": "mdr", "deliverables": [ "Client-specific threat brief", "Actionable exposure review" ], "buyer": "Business risk or IT lead", "licensing": "Security Copilot and enabled intelligence sources required; validate findings against the customer environment.", "sourceUrls": [ "https://learn.microsoft.com/en-us/defender-xdr/security-copilot-and-defender-threat-intelligence" ] }, { "id": "copilot-security-identity", "product": "Copilot", "area": "Security Copilot", "feature": "Identity investigation context", "capabilities": [ "Entra plugin insights", "Authorized identity context", "Investigation assistance" ], "useCase": "Help investigate a potentially compromised employee account before remediation.", "service": "mdr", "deliverables": [ "Identity investigation procedure", "Reviewed account-risk findings" ], "buyer": "Security or IT lead", "licensing": "Security Copilot plus relevant Entra data and roles required; underlying identity controls remain separately licensed.", "sourceUrls": [ "https://learn.microsoft.com/en-us/entra/security-copilot/security-copilot-in-entra" ] }, { "id": "copilot-security-endpoint", "product": "Copilot", "area": "Security Copilot", "feature": "Endpoint support and policy assistance", "capabilities": [ "Device troubleshooting", "Policy explanations", "Configuration conflict analysis" ], "useCase": "Help remote support staff diagnose device issues and explain security settings.", "service": "support", "deliverables": [ "Device triage playbook", "Reviewed policy recommendations" ], "buyer": "IT support manager", "licensing": "Security Copilot, Intune and plugin access required; device-query features additionally need Advanced Analytics.", "sourceUrls": [ "https://learn.microsoft.com/en-us/intune/copilot/" ] }, { "id": "copilot-security-compliance", "product": "Copilot", "area": "Security Copilot", "feature": "Compliance investigation assistance", "capabilities": [ "DLP and insider-risk summaries", "Communication review support", "eDiscovery case context" ], "useCase": "Help a law firm or CPA review data incidents and organize investigation findings.", "service": "compliance", "deliverables": [ "Reviewer investigation workflow", "Evidence review and escalation guide" ], "buyer": "Compliance or legal lead", "licensing": "Security Copilot and the relevant Purview solution licenses/roles required; no automatic legal or compliance conclusion.", "sourceUrls": [ "https://learn.microsoft.com/en-us/purview/copilot-in-purview-overview" ] }, { "id": "copilot-security-promptbooks", "product": "Copilot", "area": "Security Copilot", "feature": "Repeatable analyst promptbooks", "capabilities": [ "Saved investigation sequences", "Shared investigation patterns", "Repeatable reporting inputs" ], "useCase": "Standardize how SOC shifts collect context and prepare case notes.", "service": "mdr", "deliverables": [ "Reviewed investigation promptbooks", "Analyst quality-control checklist" ], "buyer": "SOC manager", "licensing": "Security Copilot access, enabled plugins and data permissions required; prompts need periodic maintenance.", "sourceUrls": [ "https://learn.microsoft.com/en-us/copilot/security/using-promptbooks" ] }, { "id": "copilot-security-capacity", "product": "Copilot", "area": "Security Copilot administration", "feature": "Security AI enablement and cost control", "capabilities": [ "Capacity and access planning", "Included-capacity validation", "Plugin and role configuration" ], "useCase": "Activate security AI with a clear operating budget and least-privilege access.", "service": "managed", "deliverables": [ "Security Copilot readiness checklist", "Capacity and access operating plan" ], "buyer": "IT director or finance lead", "licensing": "Separate SCU model; eligible E5/E7 inclusion depends on onboarding and capacity; do not assume unlimited access.", "sourceUrls": [ "https://learn.microsoft.com/en-us/copilot/security/security-copilot-inclusion" ] } ], "sources": [ { "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/ai-threat-protection", "title": "AI threat protection in Defender for Cloud", "notes": "GA for supported Azure AI text models; image/audio tokens not scanned; commercial-cloud scope." }, { "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management", "title": "Cloud Security Posture Management", "notes": "Foundational free versus paid Defender CSPM; preview features excluded from standard offers." }, { "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-apis-introduction", "title": "Defender for APIs", "notes": "Runtime protection for APIs published through Azure API Management." }, { "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction", "title": "Defender for App Service", "notes": "Azure App Service workload scope." }, { "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction", "title": "Defender for Cloud overview", "notes": "CSPM and separate workload protection plans; cloud/provider support differs." }, { "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction", "title": "Defender for Containers", "notes": "Cluster/provider support varies; running-container multicloud assessment preview not promised as GA." }, { "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-key-vault-introduction", "title": "Defender for Key Vault", "notes": "Key Vault threat detection; secret rotation is a Simba engineering workflow." }, { "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-servers-overview", "title": "Defender for Servers", "notes": "P1/P2 differences; server coverage separately scoped. Microsoft's separate analyst service not resold." }, { "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-introduction", "title": "Defender for Azure SQL Databases", "notes": "Supported Azure SQL/SQL deployment coverage; other engines use relevant plans." }, { "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction", "title": "Defender for Storage", "notes": "Malware scan consumption and response integrations separately scoped." }, { "url": "https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/license-and-trial-license-extention", "title": "Defender for IoT licenses", "notes": "OT site-based licensing depends on monitored device population." }, { "url": "https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/overview", "title": "Defender for IoT in Azure", "notes": "Established OT sensor deployment; separate unified Defender portal experience remains Preview." }, { "url": "https://learn.microsoft.com/en-us/azure/external-attack-surface-management/overview", "title": "Defender EASM overview", "notes": "Internet-facing discovery, inferred ownership requires validation; no cross-tenant Azure Lighthouse support." }, { "url": "https://learn.microsoft.com/en-us/azure/external-attack-surface-management/understanding-dashboards", "title": "Defender EASM dashboards", "notes": "External hygiene and inferred exposure findings require validation." }, { "url": "https://learn.microsoft.com/en-us/copilot/security/security-copilot-inclusion", "title": "Security Copilot E5/E7 inclusion", "notes": "Eligible E5/E7 capacity subject to onboarding; monthly SCU pool scales with licenses; excess use differs from seat licensing." }, { "url": "https://learn.microsoft.com/en-us/copilot/security/using-promptbooks", "title": "Use Security Copilot promptbooks", "notes": "Reusable investigation prompt sequences." }, { "url": "https://learn.microsoft.com/en-us/defender-business/mdb-overview", "title": "Microsoft Defender for Business", "notes": "Up to 300 users; server coverage requires additional licensing. Not equivalent to every Endpoint P2 capability." }, { "url": "https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-manage-app-governance", "title": "App governance", "notes": "OAuth app governance in supported Entra, Google and Salesforce environments." }, { "url": "https://learn.microsoft.com/en-us/defender-cloud-apps/proxy-intro-aad", "title": "Conditional Access app control", "notes": "Browser sessions only; unsupported native clients need separate access controls." }, { "url": "https://learn.microsoft.com/en-us/defender-cloud-apps/what-is-defender-for-cloud-apps", "title": "Defender for Cloud Apps overview", "notes": "App discovery, SSPM and information protection depend on connected app support." }, { "url": "https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-overview", "title": "Attack surface reduction rules", "notes": "Windows-specific; audit and test business applications before blocking." }, { "url": "https://learn.microsoft.com/en-us/defender-endpoint/automated-investigations", "title": "Automated endpoint investigations", "notes": "Automated investigation/remediation depends on subscription and device-group automation settings." }, { "url": "https://learn.microsoft.com/en-us/defender-endpoint/device-control-overview", "title": "Device control in Defender for Endpoint", "notes": "No server support; platform-specific capabilities. Preview encrypted-device control not offered as GA." }, { "url": "https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint", "title": "Microsoft Defender for Endpoint overview", "notes": "Supported operating systems differ in functionality." }, { "url": "https://learn.microsoft.com/en-us/defender-endpoint/next-generation-protection", "title": "Next-generation protection", "notes": "Behavioral and cloud antivirus capabilities; no universal prevention guarantee." }, { "url": "https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts", "title": "Endpoint response actions", "notes": "P1/Business/P2 response actions differ; full action set requires P2." }, { "url": "https://learn.microsoft.com/en-us/defender-endpoint/web-protection-overview", "title": "Web protection in Defender for Endpoint", "notes": "Content filtering, threat protection and custom indicators; browser-specific limits." }, { "url": "https://learn.microsoft.com/en-us/defender-for-identity/what-is", "title": "Defender for Identity overview", "notes": "Deployment and identity-source prerequisites apply; external IAM preview capabilities excluded." }, { "url": "https://learn.microsoft.com/en-us/defender-office-365/air-about", "title": "Automated investigation and response for Office 365", "notes": "Requires Defender for Office 365 P2." }, { "url": "https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-protection-about", "title": "Anti-phishing protection", "notes": "Impersonation protections require Defender for Office 365." }, { "url": "https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-get-started", "title": "Attack simulation training", "notes": "Requires applicable P2 entitlement; use authorized simulation scope." }, { "url": "https://learn.microsoft.com/en-us/defender-office-365/email-authentication-about", "title": "Email authentication", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/defender-office-365/mdo-about", "title": "Defender for Office 365 overview", "notes": "Built-in mailbox protection, P1 prevention and P2 investigation/automation are distinct tiers." }, { "url": "https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-about", "title": "Safe Attachments", "notes": "Attachment detonation and policy handling; Dynamic Delivery is Exchange Online only." }, { "url": "https://learn.microsoft.com/en-us/defender-office-365/safe-links-about", "title": "Safe Links", "notes": "Email, Teams and supported Office apps; clients and link formats impose limits." }, { "url": "https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about", "title": "Threat Explorer and real-time detections", "notes": "P1 real-time detections; P2 broader investigation and remediation." }, { "url": "https://learn.microsoft.com/en-us/defender-vulnerability-management/defender-vulnerability-management", "title": "Defender Vulnerability Management overview", "notes": "Core and premium assessment capabilities vary by entitlement." }, { "url": "https://learn.microsoft.com/en-us/defender-vulnerability-management/defender-vulnerability-management-capabilities", "title": "Vulnerability Management plans and capabilities", "notes": "Premium assessments must not be assumed included with core endpoint vulnerability management." }, { "url": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview", "title": "Advanced hunting in Microsoft Defender", "notes": "Guided/KQL hunting and custom detections; data scope depends on source entitlements." }, { "url": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-security-copilot-query-assistant", "title": "Advanced hunting query assistant", "notes": "Natural language to KQL; analyst must review queries; check tenant availability." }, { "url": "https://learn.microsoft.com/en-us/defender-xdr/api-overview", "title": "Microsoft Defender XDR APIs", "notes": "API workflow integration; applicable permissions and licensing required." }, { "url": "https://learn.microsoft.com/en-us/defender-xdr/automatic-attack-disruption", "title": "Automatic attack disruption", "notes": "Entra ID and Active Directory supported; Okta/AWS actions explicitly Preview and excluded." }, { "url": "https://learn.microsoft.com/en-us/defender-xdr/microsoft-365-defender", "title": "Microsoft Defender XDR overview", "notes": "Licensed and configured products determine available signals." }, { "url": "https://learn.microsoft.com/en-us/defender-xdr/security-copilot-and-defender-threat-intelligence", "title": "Security Copilot threat intelligence", "notes": "Actor, vulnerability, campaign and indicator intelligence." }, { "url": "https://learn.microsoft.com/en-us/defender-xdr/security-copilot-in-microsoft-365-defender", "title": "Security Copilot in Defender", "notes": "Incident summaries, guided response, script/file analysis, entity summaries, incident reports. Defender Chat is preview." }, { "url": "https://learn.microsoft.com/en-us/defender-xdr/threat-analytics", "title": "Threat analytics in Defender", "notes": "Eligible Defender entitlement needed; Endpoint P1 alone excluded; new indicators capability is Preview." }, { "url": "https://learn.microsoft.com/en-us/entra/security-copilot/security-copilot-in-entra", "title": "Security Copilot in Entra", "notes": "Identity context via authorized plugin." }, { "url": "https://learn.microsoft.com/en-us/exchange/address-books/address-book-policies/address-book-policies", "title": "Address book policies", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-ews-exchange-online", "title": "Exchange Web Services retirement", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/exchange/collaboration-exo/shared-mailboxes", "title": "Shared mailboxes", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365", "title": "Device and application email", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains", "title": "Accepted domains", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/use-connectors-to-configure-mail-flow", "title": "Mail flow connectors", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/exchange/mailbox-migration/mailbox-migration", "title": "Mailbox migration paths", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/exchange/monitoring/trace-an-email-message/message-trace-modern-eac", "title": "Message trace", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac", "title": "Application RBAC", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/exchange/permissions-exo/permissions-exo", "title": "Exchange Online permissions", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/delete-or-restore-mailboxes", "title": "Delete or restore mailboxes", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-distribution-groups/manage-distribution-groups", "title": "Distribution groups", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-resource-mailboxes", "title": "Resource mailboxes", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/manage-user-mailboxes", "title": "Manage user mailboxes", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules", "title": "Mail flow rules", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/intune/copilot/", "title": "Security Copilot in Intune", "notes": "Device troubleshooting and policy explanation; Advanced Analytics needed for device query." }, { "url": "https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-copilot-usage", "title": "Copilot Chat usage report", "notes": "Usage metrics and anonymized reporting; adoption is not itself ROI." }, { "url": "https://learn.microsoft.com/en-us/microsoft-365/backup/backup-overview", "title": "Microsoft 365 Backup", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/agent-builder", "title": "Agent Builder overview", "notes": "Declarative agents; external actions need Copilot Studio; custom skills are Frontier preview." }, { "url": "https://learn.microsoft.com/en-us/microsoft-365/copilot/faq-researcher", "title": "Researcher FAQ", "notes": "Multistep research; configured source access and administrator controls." }, { "url": "https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-overview", "title": "Microsoft Copilot overview", "notes": "Baseline chat, standard in-app access, paid work grounding; tenant permissions and feature eligibility." }, { "url": "https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-search", "title": "Copilot Search", "notes": "Unified work search and connected enterprise sources." }, { "url": "https://learn.microsoft.com/en-us/microsoft-365/documentprocessing/esignature-overview", "title": "eSignature", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/microsoft-365/documentprocessing/form-processing-overview", "title": "Structured and freeform document processing", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/microsoft-365/documentprocessing/ocr-overview", "title": "Optical character recognition", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/microsoft-365/documentprocessing/prebuilt-overview", "title": "Prebuilt document processing", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/microsoft-365/documentprocessing/syntex-overview", "title": "Document processing for Microsoft 365", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/microsoft-365/syntex/autofill-overview", "title": "Autofill columns", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/admin-data-loss-prevention", "title": "Configure data policies for agents", "notes": "Policies constrain sources, tools, HTTP requests and unauthenticated channels." }, { "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-end-user-authentication", "title": "Add user authentication to topics", "notes": "Microsoft Entra authentication, SSO and user-context access." }, { "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-generative-actions", "title": "Generative orchestration", "notes": "Agents select tools, topics and knowledge; standard harness scope." }, { "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-hand-off", "title": "Hand off to a live agent", "notes": "Live-agent escalation requires connected engagement hub." }, { "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/analytics-agent-evaluation-intro", "title": "About agent evaluation", "notes": "Test sets, grading, transcript and activity review; harness-specific availability." }, { "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/analytics-overview", "title": "Monitor overview", "notes": "Session outcomes, satisfaction, topic escalation and transcript review." }, { "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/authoring-solutions-overview", "title": "Create and manage custom solutions", "notes": "Solution-based environment movement and deployment lifecycle." }, { "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/authoring-triggers-about", "title": "Event triggers overview", "notes": "Event-driven agent execution; explicitly control action privileges." }, { "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/billing-licensing", "title": "Standard harness licensing", "notes": "Copilot Credits, prepaid/pay-as-you-go, selected M365 entitlements, trial cannot publish." }, { "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/flows-overview", "title": "Agent flows overview", "notes": "Repeatable actions and integration; actions consume capacity." }, { "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/fundamentals-what-is-copilot-studio", "title": "Copilot Studio overview", "notes": "Low-code agents and workflows; harness affects features and billing. App-creation/natural-language creation previews excluded from guaranteed scope." }, { "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/knowledge-copilot-studio", "title": "Knowledge sources summary", "notes": "Websites, documents, SharePoint, Dataverse and connectors; authenticated sources respect user access." }, { "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-add-existing-server-to-agent", "title": "Connect an existing MCP server", "notes": "Standard harness MCP, Streamable transport, API key/OAuth authentication." }, { "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/publication-fundamentals-publish-channels", "title": "Publish and deploy agents", "notes": "Deployment destinations and channel-dependent support." }, { "url": "https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-service-description", "title": "Exchange Online service description", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/office365/servicedescriptions/sharepoint-online-service-description/sharepoint-online-service-description", "title": "SharePoint service description", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/purview/ai-microsoft-purview", "title": "Security and compliance protections for generative AI", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically", "title": "Automatic sensitivity labeling", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/audit-solutions-overview", "title": "Audit solutions", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/collection-policies-solution-overview", "title": "Collection Policies", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/communication-compliance-solution-overview", "title": "Communication Compliance", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/compliance-manager", "title": "Compliance Manager", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/copilot-in-purview-overview", "title": "Security Copilot in Purview", "notes": "DLP, insider risk, communication compliance, eDiscovery context; underlying licenses remain required." }, { "url": "https://learn.microsoft.com/en-us/purview/customer-key-overview", "title": "Customer Key", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/customer-lockbox-requests", "title": "Customer Lockbox requests", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer", "title": "Activity explorer", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage-user-guide", "title": "Data lineage guide and Unified Catalog entry point", "notes": "Classic documentation links to the Unified Catalog entry point; scope varies by connector." }, { "url": "https://learn.microsoft.com/en-us/purview/data-lifecycle-management", "title": "Data Lifecycle Management", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/data-map", "title": "Data Map", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/data-security-investigations", "title": "Data Security Investigations", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/data-security-investigations-get-started", "title": "Data Security Investigations setup", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about", "title": "Data Security Posture Management", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/deploy-scanner", "title": "Information Protection scanner", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/dlp-browser-dlp-learn", "title": "Cloud-app DLP in Edge for Business", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp", "title": "Data Loss Prevention", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/dlp-network-data-security-learn", "title": "Network Data Security", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/double-key-encryption", "title": "Double Key Encryption", "notes": "DKE-protected content loses multiple cloud processing capabilities, including Copilot." }, { "url": "https://learn.microsoft.com/en-us/purview/dspm-for-ai", "title": "DSPM for AI (classic)", "notes": "Superseded by current DSPM; retain only for migration context." }, { "url": "https://learn.microsoft.com/en-us/purview/edisc", "title": "eDiscovery", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/enable-archive-mailboxes", "title": "Archive mailboxes", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/purview/endpoint-dlp-learn-about", "title": "Endpoint Data Loss Prevention", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/information-barriers", "title": "Information Barriers", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/insider-risk-management-adaptive-protection", "title": "Adaptive Protection", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/insider-risk-management-solution-overview", "title": "Insider Risk Management", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/ome", "title": "Microsoft Purview Message Encryption", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/privileged-access-management-solution-overview", "title": "Privileged Access Management", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/purview", "title": "Microsoft Purview overview", "notes": "Expanded DSPM is identified as preview." }, { "url": "https://learn.microsoft.com/en-us/purview/records-management", "title": "Records Management", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/sensitivity-labels", "title": "Sensitivity labels", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/sit-learn-about-exact-data-match-based-sits", "title": "Exact data match sensitive information types", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/sit-sensitive-information-type-learn-about", "title": "Sensitive information types", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/trainable-classifiers-learn-about", "title": "Trainable classifiers", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/unified-catalog", "title": "Unified Catalog", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/purview/unified-catalog-data-quality", "title": "Unified Catalog data quality", "notes": "Official Microsoft Learn documentation; checked 2026-10-12. Service packaging is Simba's proposed commercial mapping." }, { "url": "https://learn.microsoft.com/en-us/security-exposure-management/microsoft-security-exposure-management", "title": "Microsoft Security Exposure Management", "notes": "Adjacent Defender-portal capability, not automatically included in every Defender SKU." }, { "url": "https://learn.microsoft.com/en-us/security/zero-trust/copilots/zero-trust-microsoft-365-copilot", "title": "Apply Zero Trust to Copilot", "notes": "Identity, device and data safeguards around Copilot." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/advanced-management", "title": "SharePoint Advanced Management", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/catalog-management", "title": "Site catalog management", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices", "title": "Unmanaged device access", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/dev/business-apps/power-automate/sharepoint-connector-actions-triggers", "title": "SharePoint Power Automate connector", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/dev/general-development/get-started-with-workflows-in-sharepoint", "title": "Classic workflow retirement", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins/retirement-announcement-for-add-ins", "title": "SharePoint Add-In retirement", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/dev/spfx/sharepoint-framework-overview", "title": "SharePoint Framework", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/external-sharing-overview", "title": "External sharing", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/introduction", "title": "SharePoint and OneDrive introduction", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/manage-search-center", "title": "Search administration", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/managed-metadata", "title": "Managed metadata", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/modern-experience-sharing-permissions", "title": "Modern SharePoint permissions", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/planning-hub-sites", "title": "SharePoint hub planning", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery", "title": "Restricted content discovery", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/site-lifecycle-management", "title": "Site lifecycle management", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/teams-connected-sites", "title": "Teams and SharePoint integration", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepoint/version-overview", "title": "Version history", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/sharepointmigration/mm-get-started", "title": "Migration Manager", "notes": "Microsoft primary documentation reviewed for this capability map." }, { "url": "https://learn.microsoft.com/en-us/training/modules/phase-two-onboard/", "title": "Microsoft Copilot adoption learning", "notes": "Analyst for complex data analysis; business teams verify recommendations." }, { "url": "https://learn.microsoft.com/th-th/defender/threat-intelligence/using-tags", "title": "Legacy Defender TI retirement notice", "notes": "Standalone Defender TI retired August 1, 2026; do not market a new standalone MDTI deployment." }, { "url": "https://support.microsoft.com/en-us/excel/copilot/data-insights-with-copilot-in-excel", "title": "Get data insights with Copilot in Excel", "notes": "Formulas, lookups, charts, trends, outliers, text summaries; validate outputs." }, { "url": "https://support.microsoft.com/en-us/microsoft-365-copilot/get-started-with-microsoft-365-copilot-notebooks", "title": "Get started with Copilot Notebooks", "notes": "Curated source grounding and focused question answering." }, { "url": "https://support.microsoft.com/en-us/microsoft-365-copilot/get-started-with-microsoft-365-copilot-pages", "title": "Get started with Copilot Pages", "notes": "Persistent collaborative AI-assisted documents." }, { "url": "https://support.microsoft.com/en-us/microsoft-365-copilot/how-copilot-chat-works-in-microsoft-365-apps", "title": "Copilot Chat in Microsoft 365 apps", "notes": "Outlook inbox/calendar context and OneNote assistance; add-on changes scope." }, { "url": "https://support.microsoft.com/en-us/powerpoint/copilot/create-a-new-presentation-with-copilot-in-powerpoint", "title": "Create presentations with Copilot", "notes": "Presentation drafting from prompts and material." }, { "url": "https://support.microsoft.com/en-us/teams/copilot/catch-up-on-meetings-with-microsoft-365-copilot-in-teams", "title": "Catch up on meetings with Copilot in Teams", "notes": "Meeting discussion synthesis; transcript needed for post-meeting spoken-content review." }, { "url": "https://support.microsoft.com/en-us/word/copilot/draft-and-add-content-with-copilot-in-word", "title": "Draft and add content with Copilot in Word", "notes": "Document creation and revision with source material." } ] }