Merge pull request #21244 from MicrosoftDocs/main

Update

Author: MSFTTracyP

microsoft-365/compliance/insider-risk-management-activities.md

@@ -10,7 +10,7 @@ f1.keywords:
 ms.author: robmazz
 author: robmazz
 manager: laurawi
-ms.date: 05/09/2023
+ms.date: 06/30/2023
 audience: itpro
 ms.collection:
 - tier1
@@ -124,9 +124,30 @@ To dismiss an insider risk alert, complete the following steps:
 4. On the **Dismiss alerts** detail pane, you can review the user and policy details associated with the selected alerts.
 5. Select **Dismiss alerts** to resolve the alerts as benign or select **Cancel** to close the details pane without dismissing the alerts.
 
+## Assign an alert
+
+If you're an administrator with the appropriate permissions, you can assign ownership of an alert to yourself or to an insider risk management user with the Insider Risk Management, Insider Risk Management Analyst, or Insider Risk Management Investigator role. After an alert is assigned, you can also reassign it to a user with any of the same roles. You can only assign an alert to one admin at a time. 
+
+After an admin is assigned, you can filter by admin. 
+
+### Assign an alert from the Alerts dashboard
+
+1. In the [Microsoft Purview compliance portal](https://compliance.microsoft.com), go to **Insider risk management**, and then select the **Alerts** tab.
+2. On the **Alerts dashboard**, select the alert(s) that you want to assign.
+3. In the button bar above the alerts queue, select **Assign**. 
+4. In the **Assign owner** pane on the right side of the screen, search for an admin with the appropriate permissions, and then select the checkbox for that admin.
+5. Select **Assign**.
+
+### Assign an alert from the Alerts detail page
+
+1. In the [Microsoft Purview compliance portal](https://compliance.microsoft.com), go to **Insider risk management**, and then select the **Alerts** tab.
+2. Select an alert.
+3. In the detail pane for the alert, in the upper-right corner of the page, select **Assign**.
+4. In the **Suggested contacts** list, select the appropriate admin.
+
 ## Triage alerts
 
-To triage an insider risk alert, complete the following steps:
+To triage an insider risk alert:
 
 1. In the [Microsoft Purview compliance portal](https://compliance.microsoft.com), go to **Insider risk management** and select the **Alerts** tab.
 2. On the **Alerts dashboard**, select the alert you want to triage.

microsoft-365/compliance/insider-risk-management-cases.md

@@ -10,7 +10,7 @@ f1.keywords:
 ms.author: robmazz
 author: robmazz
 manager: laurawi
-ms.date: 02/21/2023
+ms.date: 06/30/2023
 audience: itpro
 ms.collection:
 - tier1
@@ -63,6 +63,27 @@ Use the **Search** control to search for a Case ID or to search for specific tex
 - Time case opened, start date, and end date
 - Last updated, start date, and end date
 
+## Assign a case
+
+If you're an administrator with the appropriate permissions, you can assign ownership of a case to yourself or to an insider risk management user with the Insider Risk Management, Insider Risk Management Analyst, or Insider Risk Management Investigator role. After a case is assigned, you can also reassign it to a user with any of the same roles. You can only assign a case to one admin at a time. 
+
+If an admin is assigned to a case, you can filter by admin. 
+
+### Assign a case from the Cases dashboard
+
+1. In the [Microsoft Purview compliance portal](https://compliance.microsoft.com), go to **Insider risk management**, and then select the **Cases** tab.
+2. On the **Cases dashboard**, select the case(s) that you want to assign.
+3. In the button bar above the cases queue, select **Assign**. 
+4. In the **Assign owner** pane on the right side of the screen, search for an admin with the appropriate permissions, and then select the checkbox for that admin.
+5. Select **Assign**.
+
+### Assign a case from the Cases detail page
+
+1. In the [Microsoft Purview compliance portal](https://compliance.microsoft.com), go to **Insider risk management**, and then select the **Cases** tab.
+2. Select a case.
+3. In the detail pane for the case, to the left of the **Resolve a case** button, select **Assign**.
+4. In the **Suggested contacts** list, select the appropriate admin.
+
 ## Filter cases
 
 Depending on the number and type of active insider risk management policies in your organization, reviewing a large queue of cases can be challenging. Using case filters can help analysts and investigators sort cases by several attributes. To filter alerts on the **Cases dashboard**, select the **Filter** control. You can filter cases by one or more attributes:

microsoft-365/security/office-365-security/TOC.yml

@@ -4,8 +4,8 @@
   items:
    - name: Overview
      items:
-       - name: Overview of Office 365 security
-         href: microsoft-defender-for-office-365-product-overview.md
+       - name: Why do I need Microsoft Defender for Office 365?
+         href: why-do-i-need-microsoft-defender-for-office-365.md
        - name: What's new in Defender for Office 365
          href: defender-for-office-365-whats-new.md
        - name: Zero Trust for Defender for Office 365