Mastering Configuration in Defender for Office 365 - Part Two

For all those of you who like us have had our Phishing testing completely destroyed by Microsoft which in turn messed up some of our mandatory compliance testing we do as a Health Care organization I present the solution we used to get around this boneheaded move of Microsoft's.

Since there was no way to get Microsoft to allow the mail from our Phishing Provider, KnowBe4, within the limited confines of the new system I decided to just let Microsoft quarantine them all and then use some Powershell to release the ones that I wanted.  This can be run manually or as part of a regular timed script .  You only need to make changes to to the two variables on likes 5 ($HoursBack), which dictates how far back in the quarantine the scripts looks, and line 8 ($MessageIDFilter), which dictates how to match the MessageID field which for us being KnowBe4 looks like "*@psm.knowbe4.com*".

Hope this helps others in the mess.

$i = 0
$SetSize = 1000

# Set how many hours back you wish the script to look.
$HoursBack = -1

# Set the MessageID filter you wish to use. (Example "*@psm.knowbe4.com*" for KnowBe4)
$MessageIDFilter = "*@psm.knowbe4.com*"

While ($SetSize -gt 0) {
	
	$i++
	$CurrentSet = Get-QuarantineMessage -StartReceivedDate (Get-Date).AddHours($HoursBack) -EndReceivedDate (Get-Date) -Page $i -PageSize 1000
	$FilteredSet = $CurrentSet | Where-Object {$_.MessageID -like $MessageIDFilter}
	Write-Host "Round $($i): CurrentSet = $($CurrentSet.count) and FilteredSet = $($FilteredSet.count) - Releasing Messages"
	$FilterCount = 0
	$FilteredSet | % {
		$FilterCount++
		$FilterPercentage = $FilterCount / $FilteredSet.count * 100
		$FilterPercentage = [math]::Round($FilterPercentage, 2)
		Write-Progress -Activity "Releasing Messages: $($FilterCount) - Round: $($i)" -Status "$($FilterPercentage)% Complete:" -PercentComplete $FilterPercentage
		Release-QuarantineMessage -ReleaseToAll -Identity $_.Identity}
	$SetSize = $CurrentSet.count
}