Azure Portals
Comprehensive instructions for performing changes in each Azure portal.
Entra ID
- Conditional Access Policy App Exception
- Conditional Access Policy User Exception
- Group Membership Addition
- Group Membership Removal
- External User Account Addition
- User Account MFA Reset
- User Account Disablement Action
- User Account Password Reset
- User Account Device Removal
- User PIM Eligibility Addition
- User PIM Eligibility Removal
- Entra ID Audit Log Report
- User Sign-In Log Report
- Conditional Access Policy Creation
- Conditional Access Policy Modification
- User Account Session Revocation Action
- Admin Group Membership Removal
- Admin Group Membership Addition
- App Consent Queue
- Cross-Tenant Domain Removal
- Entra ID Collaboration Domain Addition
- Entra ID Collaboration Domain Removal
- External User Account Removal
- Cross-Tenant Domain Addition
- Cross-Tenant Inbound Domain Removal
- Cross-Tenant Outbound Domain Removal
- App Consent Queue Approval Action
- App Consent Queue Denial Action
- Internal User Account Addition
- Internal User Account Removal
- Banned Password Addition
- Banned Password Removal
- Named Locations Country Addition
- Named Locations Country Removal
- Identity Protection Confirm Sign-In Compromised Action
- Identity Protection Confirm Sign-In Safe Action
- Identity Protection Dismiss Sign-In Risk Action
- Identity Protection Risky Sign-Ins Queue
- Identity Protection Block User Action
- Identity Protection Confirm User Compromised Action
- Identity Protection Confirm User Safe Action
- Identity Protection Dismiss User Risk Action
- Identity Protection Reset Password Action
- Identity Protection Risky Users Queue
- Identity Protection Unblock User Action
- MFA Registration Campaign Exception
- User Account Enablement Action
- User Password Reset Events Report
- User MFA Registration & Reset Events Report
- User Terms of Use Events Report
- User MFA Deployment Report
- User MFA Enforcement Report
- Conditional Access Enforcement Report
- MFA Registration Campaign Modification
- Enterprise Application Addition
- Enterprise Application Removal
- MFA Authentication Methods User Addition
- MFA Authentication Methods User Removal
- SSPR Authentication Methods User Addition
- SSPR Authentication Methods User Removal
- Cross-Tenant Inbound Domain Addition
- Cross-Tenant Outbound Domain Addition
- Manage Temporary Access Pass (TAP)
- User Login - Sign-in Using TAP
Intune
- Defender Web Filter Policy Creation
- Device Autopilot Reset Action
- Device Defender Intelligence Update Action
- Device Deletion
- Device BitLocker Drive Unlock Action
- Device BitLocker Key Rotation Action
- Device Full Scan Action
- Device Admin Approval Action
- Device Quick Scan Action
- Device Rename Action
- Device Restart Action
- Device Retire Action
- Device Sync Action
- Device Wipe Action
- Device Compliance Enforcement Report
- Device Configuration Profile Deployment Report
- Win32 Application Creation
- Win32 Application Modification
- Win32 Application Packaging
- Attack Surface Reduction Policy Creation
- Attack Surface Reduction Policy Modification
- Configuration Profile Policy Creation
- Configuration Profile Policy Modification
- Compliance Policy Modification
- Controlled Folder Access Policy Creation
- Controlled Folder Access Policy Modification
- Defender Antivirus Policy Creation
- Defender Antivirus Policy Modification
- Firewall Policy Creation
- Firewall Policy Modification
- BitLocker Policy Modification
- BitLocker Policy Creation
- USB Access Policy Creation
- USB Access Policy Modification
- Compliance Policy Creation
- Mobile Device Application Protection Policy Creation
- Mobile Device Application Protection Policy Modification
- Defender Attack Surface Reduction Per-Rule Exception
- Defender Attack Surface Reduction All-Rule Exception
- Defender Controlled Folder Access Application Exception
- Defender Antivirus Extension Exception
- Defender Antivirus Path Exception
- Defender Antivirus Process Exception
- Defender Extension Exception (macOS)
- Defender Path Exception (macOS)
- Defender Process Exception (macOS)
- Device FileVault Drive Unlock Action (macOS)
- Mobile Device Selective Wipe Action
- Defender Firewall Rule Addition
- Defender Firewall Rule Removal
- Defender Controlled Folder Access Folder Addition
- Defender Controlled Folder Access Folder Removal
- Browser Extension Addition
- Browser Extension Removal
- Browser Bookmark Addition
- Browser Bookmark Removal
- USB Access Device Identifier Rule Addition
- USB Access Setup Class Rule Addition
- USB Access Device Instance Identifier Rule Addition
- USB Access Read & Write Allowance
- USB Access Write Allowance
- USB Access Write Block
- USB Access Read & Write Block
- USB Access Rule Removal
- Wi-Fi Network Addition
- Wi-Fi Network Removal
- Intune Audit Log Report
- Device Action Events Report
- Mobile Device App Protection Deployment Report
- Defender Antivirus Enforcement Report
- Defender Antivirus Events Report
- Defender Firewall Enforcement Report
- Device Application Deployment Report
- Device Management Enforcement Report
- Device Autopilot Enforcement Report
- Device Autopilot Events Report
- AutoPilot Deployment Profile Creation
- Autopilot Deployment Profile Modification
- Security Baseline Creation
- Security Baseline Modification
- Device Fresh Start Action
Defender
- Defender Vulnerability Management Exception Action
- Defender Vulnerability Management Remediation Action
- Defender Vulnerability Events Report
- Defender Web Filter Events Report
- Defender for Email Quarantine Release & Allow Action
- Defender for Email Quarantine Release Action
- Defender for Email Tenant Block
- Defender for Email File Block
- Defender for Email Policy Anti-Malware Exception
- Defender for Email Policy Anti-Phishing Exception
- Defender for Email Policy Anti-Spam Exception
- Defender for Email Policy Attachment Scanning Exception
- Defender for Email Policy URL Scanning Exception
- Defender for Email URL Block
- Defender for Email Awareness Training Campaign Creation
- Defender for Email Attack Simulation Campaign Creation
- Defender for Email DKIM Domain Creation
- Defender Web Filter Policy Modification
- Defender for Email Anti-Malware Policy Creation
- Defender for Email Anti-Malware Policy Modification
- Defender for Email Anti-Phishing Policy Creation
- Defender for Email Anti-Phishing Policy Modification
- Defender for Email Anti-Spam Policy Creation
- Defender for Email Anti-Spam Policy Modification
- Defender for Email Attachment Scanning Policy Creation
- Defender for Email Attachment Scanning Policy Modification
- Defender for Email Link Scanning Policy Creation
- Defender for Email Link Scanning Policy Modification
- Defender for Email Block Sender Action
- Defender for Email Attack Simulation Launch Action
- Defender for Email Security Awareness Training Assignment Action
- Defender for Email Restricted Sender Re-Enable Action
- Defender for Email High Volume Sender Exception
- Investigating External Traffic
- Investigating Connector Configuration
- Investigating Mail Delivery
- Investigating Reply-All Impact
- Investigating URL Clicks
- Investigating Transport Rule Creation
- Investigating Tenant Wide External Traffic
- Defender for Endpoint App Execution De-Restriction Action
- Defender for Endpoint App Execution Restriction Action
- Defender for Endpoint De-Isolation Action
- Defender for Endpoint Isolation Action
- Defender for Endpoint Certificate IOC Block
- Defender for Endpoint File Hash IOC Block
- Defender for Endpoint IP IOC Block
- Defender for Endpoint URL/Domain IOC Block
- Defender for Email Download Message Action
- Defender for Email Preview Message Action
- Defender for Email Quarantine Delete Action
- Defender for Email Quarantine Queue
- Defender for Email Share Message Action
- Defender for Email Submit and Allow Action
- Defender for Email View Message Headers Action
- Defender for Email Alert Queue
- Defender for Email Alert Resolved Action
- Defender for Email Incident Queue
- Defender for Email Incident Resolved Action
- Defender for Email User Submission Queue
- Defender for Email Mark & Notify Spam Action
- Defender for Email Mark & Notify Phishing Action
- Defender for Email Mark & Notify No Threats Action
- Defender for Email Action Center Queue
- Defender for Email Action Center Approval Action
- Defender for Email Action Center Denial Action
- Defender for Email Submit and Block Action
- Defender Attack Surface Reduction Events Report
- Defender Device Security Action Center Queue
- Defender Device Security Incident Queue
- Defender Device Security Alert Queue
- Defender Web Filter Category Allowance
- Defender Web Filter Category Block
- Defender for Email Spoof Block
- Defender for Email Spam Block
- Defender for Email File Submit and Allow Action
- Defender for Email URL Submit and Allow Action
- Defender for Email Spoof Allowance
- Defender for Email Spam Allowance
- Defender for Email URL Click Events Report
- Defender for Email Message Delivery Events Report
- Defender for Email DKIM Domain Modification
- Defender for Email DKIM Domain Removal
- Defender for Email Impersonation Allowance
- Defender Alert Report
- Defender Incident Report
- Defender Firewall Events Report
- Defender USB Events Report
- Defender for Endpoint Enforcement Report
- Defender for Email Phishing Events Report
- Defender for Email Malware Events Report
- Defender for Email Deployment Report
- Defender Device Security Alert Resolved Action
- Defender Device Security Incident Resolved Action
- Defender for Endpoint Certificate IOC Allowance
- Defender for Endpoint File Hash IOC Allowance
- Defender for Endpoint IP IOC Allowance
- Defender for Endpoint URL/Domain IOC Allowance
- Defender for Email IP Address Allowance
- Defender for Email IP Address Block
Purview
- Sensitive Info Type Creation
- Sensitive Info Type Modification
- Sensitivity Label Creation
- Sensitivity Label Modification
- Sensitivity Label Publication Creation
- Sensitivity Label Publication Modification
- DLP Policy Modification
- Retention Label Auto-Apply Policy Creation
- Retention Label Auto-Apply Policy Modification
- Retention Label Creation
- Retention Label Modification
- Retention Policy Creation
- Retention Policy Modification
- DLP Policy Creation Procedure
- Purview Audit Export Action
- Purview Audit Search Action