{"id":89314,"date":"2019-04-25T09:00:27","date_gmt":"2019-04-25T16:00:27","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=89314"},"modified":"2023-05-15T23:10:33","modified_gmt":"2023-05-16T06:10:33","slug":"microsoft-threat-protection-april-update","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/","title":{"rendered":"The evolution of Microsoft Threat Protection, April update"},"content":{"rendered":"<p>Microsoft Threat Protection continues to energize the threat protection market with our most recent announcements. Customers are excited about the launch of <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/03\/21\/microsoft-defender-atp-for-mac-new-threat-and-vulnerability-management-capabilities\/\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Defender Advanced Threat Protection (ATP)<\/a>, which extends Microsoft\u2019s best in class endpoint security to Mac and adds powerful new capabilities of <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/Windows-Defender-ATP\/Introducing-a-risk-based-approach-to-threat-and-vulnerability\/ba-p\/377845\" target=\"_blank\" rel=\"noopener noreferrer\">Threat and Vulnerability Management<\/a>.<\/p>\n<p>These new features provide significant value to security administrators and operations teams with:<\/p>\n<ul>\n<li>Real-time endpoint protection, plus detection and response (EDR) insights across Windows and Mac, correlated with endpoint vulnerabilities.<\/li>\n<li>Invaluable vulnerability and misconfiguration context during incident investigations on machine or organization level.<\/li>\n<li>Built-in remediation processes through a tight integration with <a href=\"https:\/\/www.microsoft.com\/en-us\/enterprise-mobility-security\/microsoft-intune\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Intune<\/a> and Microsoft System Center Configuration Manager.<\/li>\n<\/ul>\n<p>We\u2019re committed to maintaining this pace of innovation as we continue our journey towards our <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/Security-Privacy-and-Compliance\/See-How-Microsoft-Threat-Protection-is-the-Future-of-threat\/ba-p\/360197\" target=\"_blank\" rel=\"noopener noreferrer\">ideal vision<\/a> of Microsoft Threat Protection.<\/p>\n<p>Watch Rob Lefferts deliver an update on the latest enhancements:<\/p>\n<p><iframe loading=\"lazy\" title=\"Microsoft Defender ATP: macOS preview + Threat and Vulnerability Management\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube-nocookie.com\/embed\/w2Y90xcnQ58?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><\/p>\n<p>This strong vision can only be built on a solid foundation. We want to share the details of this foundation, which enables Microsoft Threat Protection to deliver a powerful, effective, and unique threat protection solution to customers.<\/p>\n<h3>The foundation of our vision begins with a Zero Trust approach<\/h3>\n<p>Microsoft Threat Protection is built to support a <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/business\/zero-trust\" target=\"_blank\" rel=\"noopener noreferrer\">Zero Trust security<\/a> strategy because we believe the fundamental goal for any threat protection solution is to ensure bad actors don\u2019t gain access to your corporate assets. Traditional threat protection relied primarily on firewalls securing on-premises assets in a defined corporate perimeter.<\/p>\n<p>Today, most organizations are migrating to the cloud and have hybrid environments. Data is spread across multiple applications, on-premises and in the cloud, and is accessed by multiple devices (often personal devices) and users. Most organizations no longer have a <em>defined<\/em> network perimeter making traditional security tools obsolete. For today\u2019s world, Microsoft recommends organizations adopt a <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/12\/17\/zero-trust-part-1-identity-and-access-management\/\" target=\"_blank\" rel=\"noopener noreferrer\">Zero Trust model<\/a> where it\u2019s assumed that everything is on the open internet and no resources are \u201csafe.\u201d<\/p>\n<p>Zero Trust eliminates the concept of users, endpoints, or apps being trusted sources simply because they are located within the corporate network perimeter. Identity becomes the essential element connecting organizations in a Zero Trust world. Threat actors realize this and direct many campaigns at user identities, leading to 81 percent of breaches occurring through identity theft or compromise.<\/p>\n<p>With this growing trend of cyberattacks targeting identities, coupled with identity being the control plane connecting a user to all aspects of the organization (Figure 1), securing the user identity has become fundamental to business success. Because identity security is so critical, Microsoft Threat Protection is rooted to <a href=\"https:\/\/azure.microsoft.com\/en-us\/services\/active-directory\/?&amp;OCID=AID719825_SEM_hNzcjcap&amp;lnkd=Bing_Azure_Brand&amp;msclkid=b4800f1df88c1bda2af353a4976c7a75&amp;dclid=CKe43NrI2-ECFcZofgod2jEGOg\" target=\"_blank\" rel=\"noopener noreferrer\">Azure Active Directory (Azure AD)<\/a>, the most sophisticated, comprehensive, and secure identity service on the market.<\/p>\n<p>With the specific features offered as part of <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/identity-protection\/overview\" target=\"_blank\" rel=\"noopener noreferrer\">Azure AD Identity Protection<\/a>, organizations can enhance identity security with:<\/p>\n<ul>\n<li>Monitoring every sign-in to determine sign-in risk and user risk, and assess identity compromise.<\/li>\n<li>Detection of potential threats affecting your organization\u2019s cloud <em>and<\/em> on-premises identities.<\/li>\n<li>Configurations for automated protection and remediation against malicious authentications and compromised credentials.<\/li>\n<li>Investigation of suspicious incidents and appropriate actions to resolve them.<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-1.png\" target=\"_blank\" rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-89316 size-full\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-1.png\" alt=\"Image showing the control plane of Identity: Cloud apps, Partners and customers, Employees, and On-premises apps.\" width=\"1950\" height=\"879\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-1.png 1950w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-1-300x135.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-1-768x346.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-1-1024x462.png 1024w\" sizes=\"(max-width: 1950px) 100vw, 1950px\" \/><\/a><\/p>\n<p><em>Figure 1. Identity is the control plane that connects all the elements of an organization in the new world of no perimeters.<\/em><\/p>\n<p>Azure AD allows admins to create a single identity for each user from which to manage access to corporate data and apps, whether on-premises or in the cloud. Additionally, Azure AD protects internal and external users while optimizing for user productivity.<\/p>\n<p>With Azure AD as its foundation, Microsoft Threat Protection further supports a Zero Trust strategy with native integrations between Azure AD and:<\/p>\n<ul>\n<li>Cloud App Security Broker (CASB) and <a href=\"http:\/\/www.aka.ms\/mcas\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Cloud App Security<\/a>, which secure cloud apps and services.<\/li>\n<li><a href=\"https:\/\/azure.microsoft.com\/en-us\/features\/azure-advanced-threat-protection\/\" target=\"_blank\" rel=\"noopener noreferrer\">Azure ATP<\/a>, which helps detect and investigate advanced attacks on-premises and in the cloud.<\/li>\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/enterprise-mobility-security\/microsoft-intune\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Intune<\/a> (which further integrates with Microsoft Defender ATP).<\/li>\n<\/ul>\n<p>The signal shared between Azure AD and these services stitches security across the entire estate, empowering organizations using Microsoft Threat Protection to adopt a best in class Zero Trust strategy while benefitting from a seamless, fully integrated threat protection solution.<\/p>\n<h3>Executing a Zero Trust strategy with the industry\u2019s most powerful conditional access policies<\/h3>\n<p>The first layer of a powerful threat protection solution begins with securing access to organizational assets. It is imperative to ensure only the right users have access to your critical corporate assets. This task is more difficult today as more organizations adhere to a mobile-first, cloud-first strategy, allowing users to access corporate resources using myriad devices and apps from anywhere. Admins must always balance user productivity with securing corporate assets. This requires <em>not only controlling who can access a resource, but also under what conditions a resource is accessed<\/em> when making an access control decision. <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/conditional-access\/overview\" target=\"_blank\" rel=\"noopener noreferrer\">Azure AD conditional access<\/a> enables admins to make this critical determination with conditional access policies (Figure 2).<\/p>\n<p><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-2.png\" target=\"_blank\" rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-89317 size-full\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-2.png\" alt=\"Image showing conditional access policy possible conditions (which user, on what device, from where, which app), the 40 TB of real-time data assessment, and the controls applied to the access request based on conditions.\" width=\"1906\" height=\"1024\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-2.png 1906w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-2-300x161.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-2-768x413.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-2-1024x550.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-2-389x209.png 389w\" sizes=\"(max-width: 1906px) 100vw, 1906px\" \/><\/a><\/p>\n<p><em>Figure 2. Conditional access policy showing the possible conditions (which user, on what device, from where, which app), the 40 TB of real-time data assessment, and the controls applied to the access request based on conditions.<\/em><\/p>\n<p>Conditional access <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/conditional-access\/conditions\" target=\"_blank\" rel=\"noopener noreferrer\">supports various conditions<\/a>. Azure AD\u2019s <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/identity-protection\/overview-v2\" target=\"_blank\" rel=\"noopener noreferrer\">advanced machine learning models<\/a> assess each authentication coming into the service to determine the risk level. This risk evaluation feeds into conditional access policies to determine if the policy\u2019s conditions are met. Risk can be attributed to a sign-in (sign-in risk) or a user (user risk). Sign-in risk represents the probability of the identity owner authorizing the sign-in, while user risk represents the probability the user is compromised. Admins can set up automated policies (<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/conditional-access\/overview\" target=\"_blank\" rel=\"noopener noreferrer\">conditional access policies<\/a> or <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/identity-protection\/howto-configure-risk-policies\" target=\"_blank\" rel=\"noopener noreferrer\">Azure AD risk policies<\/a>) to:<\/p>\n<ul>\n<li>Remediate risky sign-ins by blocking or challenging them (<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/identity-protection\/howto-configure-risk-policies#what-is-the-sign-in-risk-policy\" target=\"_blank\" rel=\"noopener noreferrer\">sign-in risk policy<\/a>).<\/li>\n<li>Remediate risky users by blocking or forcing them to securely reset their credentials during the next sign-in (<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/identity-protection\/howto-configure-risk-policies#what-is-a-user-risk-policy\" target=\"_blank\" rel=\"noopener noreferrer\">user risk policy<\/a>).<\/li>\n<\/ul>\n<p>When a user attempts to access any corporate asset,<strong> 40TB<\/strong> of data\u2014which includes detections for users with leaked credentials, sign-ins from anonymous IP addresses, impossible travel to atypical locations, sign-ins from unfamiliar locations, and sign-ins from infected devices\u2014is assessed to determine the real-time risk level. Based on the risk level, access is granted or blocked, helping ensure an organization\u2019s most important and critical assets are only accessed by users who meet the conditional access policy criteria.<\/p>\n<p>As shown in Figure 3, blocked access is considered a new risk event, raising the user risk level. For any subsequent access request, the user must meet criteria for a stricter conditional access policy to gain access. All the other services in Microsoft Threat Protection build from this dynamic and powerful layer of security. This secure foundation ensures only the least risky users have access to critical corporate assets. <em>Conditional access is extremely powerful because when only the least risky users are granted access, the overall risk to the organization is significantly reduced<\/em>.<\/p>\n<p><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/04\/Identity-Protection-Animation-Gray-3.gif\" target=\"_blank\" rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-89333 size-full\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/04\/Identity-Protection-Animation-Gray-3.gif\" alt=\"Image showing Azure AD conditional access assigning a risk score to an access request and updating the risk score based on new detections.\" width=\"1920\" height=\"1080\" \/><\/a><\/p>\n<p><em>Figure 3. Azure AD conditional access assigns a risk score to an access request and updates the risk score based on any new detections.<\/em><\/p>\n<h3>Risk-based in-session controls<\/h3>\n<p>Microsoft Threat Protection\u2019s identity security also offers continuous monitoring and control of user activities in real-time. This critical capability enables organizations to decide on the actions users can carry out across cloud apps, based on the user risk determined at time of sign-in. Continuous monitoring of in-session user behavior and dynamic, real-time evaluation of risk levels helps to ensure the user is not a potential threat actor using a compromised identity. The integration between Azure AD conditional access and Microsoft Cloud App Security unlocks the ability to monitor user behavior and control activities in real-time, after they gain access to a cloud application, and will therefore also protect organizational resources in the event an account is compromised.<\/p>\n<p>The example in Figure 4 demonstrates a scenario where an external user, on an unmanaged device, attempts to access a file in Box. The sign-in is authenticated by Azure AD, which calculates both sign-in and user risk. Azure AD defines the user risk level based on factors such as device compliance and location to determine whether Microsoft Cloud App Security will limit any in-session user activities or provide full access to cloud apps. As a result of the session level risk, the user session is routed via Microsoft Cloud App Security where potentially risky user actions such a downloading sensitive information or uploading files are blocked, preventing data exfiltration or infiltration. In the case shown below, the policy allows the user to view the file, but does not allow for file download due to the higher risk of an external user on an unmanaged device.<\/p>\n<p><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-4.png\" target=\"_blank\" rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-89319 size-full\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-4.png\" alt=\"Image showing an external user blocked from downloading a file with an unmanaged device.\" width=\"1829\" height=\"615\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-4.png 1829w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-4-300x101.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-4-768x258.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-4-1024x344.png 1024w\" sizes=\"(max-width: 1829px) 100vw, 1829px\" \/><\/a><\/p>\n<p><em>Figure 4. Blocking an external user from downloading a file with an unmanaged device.<\/em><\/p>\n<h3>Powerful threat investigation and response capabilities for potentially compromised identities<\/h3>\n<p>Threat protection is only complete with effective response for the inevitable threats which penetrate your environment. Azure AD\u2019s new integration with Azure ATP offers a powerful SecOps capability for threat response (in preview). As noted, integration between Azure AD and Microsoft Cloud App Security enables continuous monitoring of user behavior from sign-in through the entire session. Microsoft Threat Protection\u2019s identity services leverage user behavior analytics to create a dynamic <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/Enterprise-Mobility-Security\/Introducing-Investigation-Priority-built-on-User-and-Entity\/ba-p\/360853\" target=\"_blank\" rel=\"noopener noreferrer\">investigation priority score<\/a> based off signal from Azure AD, Microsoft Cloud App Security, and Azure ATP. The investigation priority is calculated from assessing security alerts, abnormal activities, and potential business and asset impact related to each user.<\/p>\n<p>This score can help SecOps teams focus and respond to the top user threats in the organization. Azure ATP also provides recommendations on what actions to take to effectively remediate the threat. This new investigation and response capability, plus the protection and detection capabilities we described earlier, together offer customers truly comprehensive identity security with Microsoft Threat Protection.<\/p>\n<p><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-5.png\" target=\"_blank\" rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-89320 size-full\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-5.png\" alt=\"Image showing the investigation priority score of a user with a summary of user alerts.\" width=\"1433\" height=\"783\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-5.png 1433w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-5-300x164.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-5-768x420.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/04\/Microsoft-Threat-Protection-April-update-5-1024x560.png 1024w\" sizes=\"(max-width: 1433px) 100vw, 1433px\" \/><\/a><\/p>\n<p><em>Figure 5. Investigation priority score of a user with a summary of the user alerts.<\/em><\/p>\n<h3>Experience the evolution of Microsoft Threat Protection<\/h3>\n<p>Take a moment to\u00a0<a href=\"https:\/\/techcommunity.microsoft.com\/t5\/Security-Privacy-and-Compliance\/Announcing-Microsoft-Threat-Protection\/ba-p\/262783\" target=\"_blank\" rel=\"noopener noreferrer\">learn more about Microsoft Threat Protection<\/a>, read our previous\u00a0<a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/the-evolution-of-microsoft-threat-protection\/\" target=\"_blank\" rel=\"noopener noreferrer\">monthly updates<\/a>, and visit our <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/technology\/threat-protection\" target=\"_blank\" rel=\"noopener noreferrer\">website<\/a>.<\/p>\n<p><a href=\"https:\/\/customers.microsoft.com\/en-us\/story\/telit-professional-services-microsoft-365\" target=\"_blank\" rel=\"noopener noreferrer\">Organizations<\/a> have already transitioned to Microsoft Threat Protection and <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/What-s-New\/SecOps-is-more-effective-thanks-to-Microsoft-Windows-Defender\/m-p\/272925#M145\" target=\"_blank\" rel=\"noopener noreferrer\">partners<\/a> are leveraging its powerful capabilities. Begin a trial of Microsoft Threat Protection services today to experience the benefits of the most comprehensive, integrated, and secure threat protection solution for the modern workplace.<\/p>\n<ul>\n<li><a href=\"https:\/\/docs.microsoft.com\/en-us\/enterprise-mobility-security\/mtptrial\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Threat Protection trial<\/a><\/li>\n<li>Microsoft Threat Protection\u2019s new SIEM, <a href=\"https:\/\/azure.microsoft.com\/en-us\/free\/\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Azure Sentinel<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Learn about the latest updates to Microsoft Threat Protection and the details of its foundation built on supporting Zero Trust.<\/p>\n","protected":false},"author":96,"featured_media":88408,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3662],"topic":[3687,3688,3689],"products":[3690,3694],"threat-intelligence":[3739],"tags":[],"coauthors":[1916],"class_list":["post-89314","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-news","topic-threat-intelligence","topic-threat-trends","topic-zero-trust","products-microsoft-defender","products-microsoft-defender-for-endpoint","threat-intelligence-vulnerabilities-and-exploits"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>The evolution of Microsoft Threat Protection, April update<\/title>\n<meta name=\"description\" content=\"Learn about the latest updates to Microsoft Threat Protection and the details of its foundation built on supporting Zero Trust.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The evolution of Microsoft Threat Protection, April update\" \/>\n<meta property=\"og:description\" content=\"Learn about the latest updates to Microsoft Threat Protection and the details of its foundation built on supporting Zero Trust.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2019-04-25T16:00:27+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-05-16T06:10:33+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/02\/OfficeNews_SecurityBlog_Header_04_Blue.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"500\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Microsoft Security Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/02\/OfficeNews_SecurityBlog_Header_04_Blue.png\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Microsoft Security Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/microsoft-secure-blog-staff\/\",\"@type\":\"Person\",\"@name\":\"Microsoft Security Team\"}],\"headline\":\"The evolution of Microsoft Threat Protection, April update\",\"datePublished\":\"2019-04-25T16:00:27+00:00\",\"dateModified\":\"2023-05-16T06:10:33+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/\"},\"wordCount\":1705,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/01\/OfficeNews_SecurityBlog_Apr_Blog.png\",\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/\",\"name\":\"The evolution of Microsoft Threat Protection, April update\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/01\/OfficeNews_SecurityBlog_Apr_Blog.png\",\"datePublished\":\"2019-04-25T16:00:27+00:00\",\"dateModified\":\"2023-05-16T06:10:33+00:00\",\"description\":\"Learn about the latest updates to Microsoft Threat Protection and the details of its foundation built on supporting Zero Trust.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/01\/OfficeNews_SecurityBlog_Apr_Blog.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/01\/OfficeNews_SecurityBlog_Apr_Blog.png\",\"width\":440,\"height\":268,\"caption\":\"Microsoft Threat Protection - April 2019 Edition\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The evolution of Microsoft Threat Protection, April update\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The evolution of Microsoft Threat Protection, April update","description":"Learn about the latest updates to Microsoft Threat Protection and the details of its foundation built on supporting Zero Trust.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/","og_locale":"en_US","og_type":"article","og_title":"The evolution of Microsoft Threat Protection, April update","og_description":"Learn about the latest updates to Microsoft Threat Protection and the details of its foundation built on supporting Zero Trust.","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/","og_site_name":"Microsoft Security Blog","article_published_time":"2019-04-25T16:00:27+00:00","article_modified_time":"2023-05-16T06:10:33+00:00","og_image":[{"width":1600,"height":500,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/02\/OfficeNews_SecurityBlog_Header_04_Blue.png","type":"image\/png"}],"author":"Microsoft Security Team","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/02\/OfficeNews_SecurityBlog_Header_04_Blue.png","twitter_misc":{"Written by":"Microsoft Security Team","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/microsoft-secure-blog-staff\/","@type":"Person","@name":"Microsoft Security Team"}],"headline":"The evolution of Microsoft Threat Protection, April update","datePublished":"2019-04-25T16:00:27+00:00","dateModified":"2023-05-16T06:10:33+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/"},"wordCount":1705,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/01\/OfficeNews_SecurityBlog_Apr_Blog.png","inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/","name":"The evolution of Microsoft Threat Protection, April update","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/01\/OfficeNews_SecurityBlog_Apr_Blog.png","datePublished":"2019-04-25T16:00:27+00:00","dateModified":"2023-05-16T06:10:33+00:00","description":"Learn about the latest updates to Microsoft Threat Protection and the details of its foundation built on supporting Zero Trust.","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/01\/OfficeNews_SecurityBlog_Apr_Blog.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/01\/OfficeNews_SecurityBlog_Apr_Blog.png","width":440,"height":268,"caption":"Microsoft Threat Protection - April 2019 Edition"},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/04\/25\/microsoft-threat-protection-april-update\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"The evolution of Microsoft Threat Protection, April update"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}}]}},"msxcm_display_generated_audio":false,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/89314"}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=89314"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/89314\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media\/88408"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=89314"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=89314"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=89314"},{"taxonomy":"products","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/products?post=89314"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=89314"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/tags?post=89314"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=89314"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}