Unable to Retrieve Policy ID for Endpoint Security Policies via Graph API

Hello Ms. M, thanks for coming into forums. I'm also a user like you and I'll be more than happy to help you to the best of my knowledge.

Yes, you can check which policy was applied to a user in Microsoft Defender for Cloud Apps by reviewing the audit logs.

To access the audit logs, follow these steps:

-Go to the Microsoft 365 security center.
-Click on the "Threat management" section, and then click on "Audit log search".
-In the "Audit log search" page, you can select "Cloud App Security" as the source and then specify the date range and user account to search for events related to Defender for Cloud Apps.
-Once the events are displayed, you can look for events related to "File upload blocked" or "Policy applied". These events will include information on which policy was triggered and applied.

You can also filter the events by policy name to quickly find the specific policy that was triggered.

Hope this info helps. Feel free to let us know.

Warm Regards,
Myk

Dear Geotrix,
I am Renzo, as an Independent Advisor and Office user, I'll help you with your question.

You can use Microsoft Graph to create an app that connects with files across OneDrive, OneDrive for Business, and SharePoint document libraries. With Microsoft Graph, you can build a variety of experiences with files stored in Microsoft 365, from simply storing user documents to complex file-sharing scenarios.

Take a look at below link for further information:
https://docs.microsoft.com/en-us/graph/api/reso...

API reference:
https://docs.microsoft.com/en-us/graph/onedrive...
<br />

Hallo Desislava Dimova,

auch das hat leider nicht funktioniert. Ich bekomme folgende Fehlermeldung: "Unable to remove this Domain. Use Get-MsolUser -DomainName <domain name> to retrieve a list ob objects that are blocking removal."

Aber dieser Befehl liefert keine User zurück. Es gibt auch keine User mehr, die diese Domain verwenden.

Hast du noch eine Idee? Vielen Dank für Deine Hilfe.

Hallo Peter Ess,



Bedanke mich für die Erläuterung



Was mit den Elementen nach dem 365 Tag passiert hängt von der Aufbewahrungsrichtlinie ab.



What happens when the hold duration expires?



When the hold duration expires for a mailbox item in the Recoverable Items folder, the item is permanently deleted (purged) from the inactive mailbox. If there is no duration specified for the hold placed on the inactive mailbox, items in the Recoverable
Items folder are never purged (unless the hold duration for the inactive mailbox is changed).



Is retention policy still processed on inactive mailboxes?



If a retention policy was applied to a mailbox when it was made inactive, the deletion policies (which are retention tags configured with a Delete retention action) will continue to be processed on the inactive mailbox. That means items that are tagged with
a deletion policy are moved to the Recoverable Items folder when the retention period expires. Those items are then purged from the inactive mailbox when the hold duration for an item expires.



Conversely, any archive policies (which are retention tags configured with a MoveToArchive retention action) that are included in the retention policy assigned to an inactive mailbox are ignored. That means items in an inactive mailbox that are tagged with
an archive policy remain in the primary mailbox when the retention period expires. They're not moved to the archive mailbox or to the Recoverable Items folder in the archive mailbox. Because a user can't sign in to an inactive mailbox, there's no reason to
consume datacenter resources to process archive policies.



Quelle:
Change the hold duration for an inactive mailbox in Exchange Online



Für weitere Fragen stehe ich gerne zur Verfügung.



Mit freundlichen Grüßen,



Desislava Dimova



Microsoft Office 365 Support Engineer

Hallo,

ich habe dieses Rezept (deinstallation von Kaspersky Endpoint Security) jetzt nochmals abgearbeitet und siehe da. Im Moment scheint Office 2013 vernünftig isntalliert und die Anwendungen (word,excel,ppt) lassen sich öffnen.

Kann ich jetzt mein Kaspersky Endpoint Security wieder beruhigt installieren oder besteht die Gefahr, dass dies wieder Einfluss auf die Ausführbarkeit meiner Office-Anwendungen hat?

Gruss

Dieter