From 297d24ec242fb63d53166832735077bd90f0a4ee Mon Sep 17 00:00:00 2001
From: adirdidi <68847945+adirdidi@users.noreply.github.com>
Date: Thu, 31 Dec 2020 02:21:33 +0200
Subject: [PATCH 1/8] Update gov.md
1. Changing "GCC-High" to "GCC High" (aligning with Office documentation).
2. Some styling changes after reviewing the page design.
---
.../microsoft-defender-atp/gov.md | 58 ++++++++++---------
1 file changed, 31 insertions(+), 27 deletions(-)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md
index c231415275..a9913d65b3 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/gov.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md
@@ -26,10 +26,11 @@ ms.topic: conceptual
Microsoft Defender for Endpoint for US Government customers, built in the US Azure Government environment, uses the same underlying technologies as Defender for Endpoint in Azure Commercial.
-This offering is currently available to Microsoft 365 GCC and GCC-High customers and is based on the same prevention, detection, investigation, and remediation as the commercial version. However, there are some differences in the availability of capabilities for this offering.
+This offering is currently available to Microsoft 365 GCC and GCC High customers and is based on the same prevention, detection, investigation, and remediation as the commercial version. However, there are some differences in the availability of capabilities for this offering.
> [!NOTE]
> If you are a "GCC on Commercial" customer, please refer to the public documentation pages.
+
## Endpoint versions
@@ -37,16 +38,16 @@ This offering is currently available to Microsoft 365 GCC and GCC-High customers
### Standalone OS versions
The following OS versions are supported:
-OS version | GCC | GCC-High
+OS version | GCC | GCC High
:---|:---|:---
Windows 10, version 20H2 (with [KB4586853](https://support.microsoft.com/help/4490481)) |  | 
-Windows 10, version 2004 - 20H1 (with [KB4586853](https://support.microsoft.com/help/4490481)) |  | 
-Windows 10, version 1909 - 19H2 (with [KB4586819](https://support.microsoft.com/help/4586819)) |  | 
-Windows 10, version 1903 - 19H1 (with [KB4586819](https://support.microsoft.com/help/4586819)) |  | 
-Windows 10, version 1809 - RS5 (with [KB4586839](https://support.microsoft.com/help/4586839)) |  | 
-Windows 10, version 1803 - RS4 | 
Coming soon | 
With [KB4499183](https://support.microsoft.com/help/4499183)
-Windows 10, version 1709 - RS3 | 
Note: Will not be supported | 
With [KB4499147](https://support.microsoft.com/help/4499147)
Note: Will be deprecated, please upgrade
-Windows 10, version 1703 - RS2 and below | 
Note: Will not be supported | 
Note: Will not be supported
+Windows 10, version 2004 / 20H1 (with [KB4586853](https://support.microsoft.com/help/4490481)) |  | 
+Windows 10, version 1909 / 19H2 (with [KB4586819](https://support.microsoft.com/help/4586819)) |  | 
+Windows 10, version 1903 / 19H1 (with [KB4586819](https://support.microsoft.com/help/4586819)) |  | 
+Windows 10, version 1809 / RS5 (with [KB4586839](https://support.microsoft.com/help/4586839)) |  | 
+Windows 10, version 1803 / RS4 | 
Coming soon |  With [KB4499183](https://support.microsoft.com/help/4499183)
+Windows 10, version 1709 / RS3 | 
Note: Will not be supported |  With [KB4499147](https://support.microsoft.com/help/4499147)
**Note:** Will be deprecated, please upgrade to a later version
+Windows 10, version 1703 / RS2 and below | 
Note: Will not be supported | 
Note: Will not be supported
Windows Server 2019 (with [KB4586839](https://support.microsoft.com/help/4586839)) |  | 
Windows Server 2016 |  | 
Windows Server 2012 R2 |  | 
@@ -66,22 +67,23 @@ Android |  | 
### OS versions when using Azure Security Center
The following OS versions are supported when using [Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp):
-OS version | GCC | GCC-High
+OS version | GCC | GCC High
:---|:---|:---
Windows Server 2016 |  | 
Windows Server 2012 R2 |  | 
Windows Server 2008 R2 SP1 |  | 
-
+
## Required connectivity settings
You'll need to ensure that traffic from the following are allowed:
Service location | DNS record
:---|:---
-Common URLs for all locations (Global location) | ```crl.microsoft.com```
```ctldl.windowsupdate.com```
```notify.windows.com```
```settings-win.data.microsoft.com```
NOTE: ```settings-win.data.microsoft.com``` is only needed on Windows 10 devices running version 1803 or earlier.
+Common URLs for all locations (Global location) | ```crl.microsoft.com```
```ctldl.windowsupdate.com```
```notify.windows.com```
```settings-win.data.microsoft.com```
Note: ```settings-win.data.microsoft.com``` is only needed on Windows 10 devices running version 1803 or earlier.
Common URLs for all US Gov customers | ```us4-v20.events.data.microsoft.com```
```*.blob.core.usgovcloudapi.net```
Defender for Endpoint GCC specific | ```winatp-gw-usmt.microsoft.com```
```winatp-gw-usmv.microsoft.com```
-Defender for Endpoint GCC-High specific | ```winatp-gw-usgt.microsoft.com```
```winatp-gw-usgv.microsoft.com```
+Defender for Endpoint GCC High specific | ```winatp-gw-usgt.microsoft.com```
```winatp-gw-usgv.microsoft.com```
+
## API
@@ -90,28 +92,30 @@ Instead of the public URIs listed in our [API documentation](https://docs.micros
Environment | Login endpoint | Defender for Endpoint API endpoint
:---|:---|:---
GCC | ```https://login.microsoftonline.com``` | ```https://api-gcc.securitycenter.microsoft.us```
-GCC-High | ```https://login.microsoftonline.us``` | ```https://api-gov.securitycenter.microsoft.us```
+GCC High | ```https://login.microsoftonline.us``` | ```https://api-gov.securitycenter.microsoft.us```
+
## Feature parity with commercial
Defender for Endpoint do not have complete parity with the commercial offering. While our goal is to deliver all commercial features and functionality to our US Government customers, there are some capabilities not yet available that we'd like to highlight.
+
These are the known gaps as of January 2021:
-Feature | GCC | GCC-High
+Feature name | GCC | GCC High
:---|:---|:---
Threat analytics |  | 
Threat & vulnerability management |  | 
-Automated investigation and remediation:
Response to Office 365 alerts |  | 
-Automated investigation and remediation:
Live response |  | 
-Management and APIs:
Threat protection report |  | 
-Management and APIs:
Device health and compliance report |  | 
-Management and APIs:
Integration with third-party products |  | 
+Automated investigation and remediation: Response to Office 365 alerts |  | 
+Automated investigation and remediation: Live response |  | 
+Management and APIs: Threat protection report |  | 
+Management and APIs: Device health and compliance report |  | 
+Management and APIs: Integration with third-party products |  | 
Email notifications |  | 
-Integrations:
Azure Sentinel |  | 
-Integrations:
Microsoft Cloud App Security |  | 
-Integrations:
Microsoft Defender for Identity |  | 
-Integrations:
Microsoft Defender for Office 365 |  | 
-Integrations:
Microsoft Endpoint DLP |  | 
-Integrations:
Microsoft Intune |  | 
-Integrations:
Skype for Business / Teams |  | 
+Integrations: Azure Sentinel |  | 
+Integrations: Microsoft Cloud App Security |  | 
+Integrations: Microsoft Defender for Identity |  | 
+Integrations: Microsoft Defender for Office 365 |  | 
+Integrations: Microsoft Endpoint DLP |  | 
+Integrations: Microsoft Intune |  | 
+Integrations: Skype for Business / Teams |  | 
Microsoft Threat Experts |  | 
From 2f4113f3db7996e6deb98e47c61568721cd52178 Mon Sep 17 00:00:00 2001
From: adirdidi <68847945+adirdidi@users.noreply.github.com>
Date: Thu, 31 Dec 2020 02:26:34 +0200
Subject: [PATCH 2/8] Update gov.md
---
.../security/threat-protection/microsoft-defender-atp/gov.md | 3 +++
1 file changed, 3 insertions(+)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md
index a9913d65b3..f05499abc5 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/gov.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md
@@ -72,6 +72,7 @@ OS version | GCC | GCC High
Windows Server 2016 |  | 
Windows Server 2012 R2 |  | 
Windows Server 2008 R2 SP1 |  | 
+
## Required connectivity settings
@@ -83,6 +84,7 @@ Common URLs for all locations (Global location) | ```crl.microsoft.com```
```
Common URLs for all US Gov customers | ```us4-v20.events.data.microsoft.com```
```*.blob.core.usgovcloudapi.net```
Defender for Endpoint GCC specific | ```winatp-gw-usmt.microsoft.com```
```winatp-gw-usmv.microsoft.com```
Defender for Endpoint GCC High specific | ```winatp-gw-usgt.microsoft.com```
```winatp-gw-usgv.microsoft.com```
+
@@ -93,6 +95,7 @@ Environment | Login endpoint | Defender for Endpoint API endpoint
:---|:---|:---
GCC | ```https://login.microsoftonline.com``` | ```https://api-gcc.securitycenter.microsoft.us```
GCC High | ```https://login.microsoftonline.us``` | ```https://api-gov.securitycenter.microsoft.us```
+
From 1ca00337aa342f22618c3568a4dea62360b56801 Mon Sep 17 00:00:00 2001
From: adirdidi <68847945+adirdidi@users.noreply.github.com>
Date: Thu, 31 Dec 2020 02:44:49 +0200
Subject: [PATCH 3/8] Update gov.md
---
.../security/threat-protection/microsoft-defender-atp/gov.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md
index f05499abc5..a7e469fb1b 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/gov.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md
@@ -46,7 +46,7 @@ Windows 10, version 1909 / 19H2 (with [KB4586819](https://support.microsoft.com/
Windows 10, version 1903 / 19H1 (with [KB4586819](https://support.microsoft.com/help/4586819)) |  | 
Windows 10, version 1809 / RS5 (with [KB4586839](https://support.microsoft.com/help/4586839)) |  | 
Windows 10, version 1803 / RS4 | 
Coming soon |  With [KB4499183](https://support.microsoft.com/help/4499183)
-Windows 10, version 1709 / RS3 | 
Note: Will not be supported |  With [KB4499147](https://support.microsoft.com/help/4499147)
**Note:** Will be deprecated, please upgrade to a later version
+Windows 10, version 1709 / RS3 | 
Note: Will not be supported |  With [KB4499147](https://support.microsoft.com/help/4499147)
Note: Will be deprecated, please upgrade
Windows 10, version 1703 / RS2 and below | 
Note: Will not be supported | 
Note: Will not be supported
Windows Server 2019 (with [KB4586839](https://support.microsoft.com/help/4586839)) |  | 
Windows Server 2016 |  | 
From 81ecb7c4a5be13b6c641002d88e98dfe57b6940d Mon Sep 17 00:00:00 2001
From: adirdidi <68847945+adirdidi@users.noreply.github.com>
Date: Thu, 31 Dec 2020 02:50:50 +0200
Subject: [PATCH 4/8] Update gov.md
---
.../security/threat-protection/microsoft-defender-atp/gov.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md
index a7e469fb1b..6c05fa0d30 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/gov.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md
@@ -1,5 +1,5 @@
---
-title: Microsoft Defender ATP for US Government customers
+title: Microsoft Defender for Endpoint for US Government customers
description: Learn about the requirements and the available Microsoft Defender for Endpoint capabilities for US Government customers
keywords: government, gcc, high, requirements, capabilities, defender, defender atp, mdatp, endpoint, dod
search.product: eADQiWindows 10XVcnh
From f5a28ebc99bc3478c571e23d3f659c61062fb169 Mon Sep 17 00:00:00 2001
From: adirdidi <68847945+adirdidi@users.noreply.github.com>
Date: Thu, 31 Dec 2020 02:55:18 +0200
Subject: [PATCH 5/8] Update gov.md
---
.../security/threat-protection/microsoft-defender-atp/gov.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md
index 6c05fa0d30..3315f0bd21 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/gov.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md
@@ -45,7 +45,7 @@ Windows 10, version 2004 / 20H1 (with [KB4586853](https://support.microsoft.com/
Windows 10, version 1909 / 19H2 (with [KB4586819](https://support.microsoft.com/help/4586819)) |  | 
Windows 10, version 1903 / 19H1 (with [KB4586819](https://support.microsoft.com/help/4586819)) |  | 
Windows 10, version 1809 / RS5 (with [KB4586839](https://support.microsoft.com/help/4586839)) |  | 
-Windows 10, version 1803 / RS4 | 
Coming soon |  With [KB4499183](https://support.microsoft.com/help/4499183)
+Windows 10, version 1803 / RS4 |  Coming soon |  With [KB4499183](https://support.microsoft.com/help/4499183)
Windows 10, version 1709 / RS3 | 
Note: Will not be supported |  With [KB4499147](https://support.microsoft.com/help/4499147)
Note: Will be deprecated, please upgrade
Windows 10, version 1703 / RS2 and below | 
Note: Will not be supported | 
Note: Will not be supported
Windows Server 2019 (with [KB4586839](https://support.microsoft.com/help/4586839)) |  | 
From 15c1cf1431350e75ccf9b3a294a3263abcdf8dc0 Mon Sep 17 00:00:00 2001
From: adirdidi <68847945+adirdidi@users.noreply.github.com>
Date: Thu, 31 Dec 2020 03:16:06 +0200
Subject: [PATCH 6/8] Update gov.md
---
.../security/threat-protection/microsoft-defender-atp/gov.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md
index 3315f0bd21..1d8a960e5e 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/gov.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md
@@ -113,7 +113,7 @@ Automated investigation and remediation: Live response |  | 
Management and APIs: Device health and compliance report |  | 
Management and APIs: Integration with third-party products |  | 
-Email notifications |  | 
+Email notifications |  Coming soon | 
Integrations: Azure Sentinel |  | 
Integrations: Microsoft Cloud App Security |  | 
Integrations: Microsoft Defender for Identity |  | 
From 0899d50c7138683c81942fb9e0da1866d1206082 Mon Sep 17 00:00:00 2001
From: adirdidi <68847945+adirdidi@users.noreply.github.com>
Date: Thu, 31 Dec 2020 03:27:14 +0200
Subject: [PATCH 7/8] Update gov.md
---
.../security/threat-protection/microsoft-defender-atp/gov.md | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md
index 1d8a960e5e..2f6f4b6d4e 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/gov.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md
@@ -112,10 +112,13 @@ Automated investigation and remediation: Response to Office 365 alerts |  | 
Management and APIs: Threat protection report |  | 
Management and APIs: Device health and compliance report |  | 
+Management and APIs: Streaming API |  | 
Management and APIs: Integration with third-party products |  | 
-Email notifications |  Coming soon | 
+Email notifications |  Coming soon | 
+Web content filtering |  Coming soon | 
Integrations: Azure Sentinel |  | 
Integrations: Microsoft Cloud App Security |  | 
+Integrations: Microsoft Compliance Center |  | 
Integrations: Microsoft Defender for Identity |  | 
Integrations: Microsoft Defender for Office 365 |  | 
Integrations: Microsoft Endpoint DLP |  | 
From 8b19472b8a296de6de33f097f1c75403e60981e3 Mon Sep 17 00:00:00 2001
From: Gary Moore
Date: Wed, 30 Dec 2020 19:24:25 -0800
Subject: [PATCH 8/8] Replaced triple backticks with single backticks
Triple backticks are for creating code blocks with a Copy button and possibly a label for the type of content. Single backticks are for simply formatting text in a fixed-width font for code.
---
.../threat-protection/microsoft-defender-atp/gov.md | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md
index 2f6f4b6d4e..3e44dc54bc 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/gov.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md
@@ -80,10 +80,10 @@ You'll need to ensure that traffic from the following are allowed:
Service location | DNS record
:---|:---
-Common URLs for all locations (Global location) | ```crl.microsoft.com```
```ctldl.windowsupdate.com```
```notify.windows.com```
```settings-win.data.microsoft.com```
Note: ```settings-win.data.microsoft.com``` is only needed on Windows 10 devices running version 1803 or earlier.
-Common URLs for all US Gov customers | ```us4-v20.events.data.microsoft.com```
```*.blob.core.usgovcloudapi.net```
-Defender for Endpoint GCC specific | ```winatp-gw-usmt.microsoft.com```
```winatp-gw-usmv.microsoft.com```
-Defender for Endpoint GCC High specific | ```winatp-gw-usgt.microsoft.com```
```winatp-gw-usgv.microsoft.com```
+Common URLs for all locations (Global location) | `crl.microsoft.com`
`ctldl.windowsupdate.com`
`notify.windows.com`
`settings-win.data.microsoft.com`
Note: `settings-win.data.microsoft.com` is only needed on Windows 10 devices running version 1803 or earlier.
+Common URLs for all US Gov customers | `us4-v20.events.data.microsoft.com`
`*.blob.core.usgovcloudapi.net`
+Defender for Endpoint GCC specific | `winatp-gw-usmt.microsoft.com`
`winatp-gw-usmv.microsoft.com`
+Defender for Endpoint GCC High specific | `winatp-gw-usgt.microsoft.com`
`winatp-gw-usgv.microsoft.com`
@@ -93,8 +93,8 @@ Instead of the public URIs listed in our [API documentation](https://docs.micros
Environment | Login endpoint | Defender for Endpoint API endpoint
:---|:---|:---
-GCC | ```https://login.microsoftonline.com``` | ```https://api-gcc.securitycenter.microsoft.us```
-GCC High | ```https://login.microsoftonline.us``` | ```https://api-gov.securitycenter.microsoft.us```
+GCC | `https://login.microsoftonline.com` | `https://api-gcc.securitycenter.microsoft.us`
+GCC High | `https://login.microsoftonline.us` | `https://api-gov.securitycenter.microsoft.us`