Recent Discussions
email quarantine and reason "high confidence phish"
Hi I started testing a phishing email campaign from an external vendor KnowBe4. The emails keep going to quarantine reason "high confidence phish" What is the best way to fix this? I tried excluded the URL from Safe Links and added their sender IPs to O365 Tenant allow/block list. Thank you in advanced.
Attack Simulation Phishing Tool - IP whitelist
I'm trying to find IP's or domains to whitelist when using the Attack Simulation Phishing Tool. We currently use proofpoint but are planning to move into O365/Exchange online. Would a whitelist for MS's own simulation tool be needed once we move away from Proofpoint?
Attack Simulation goes to Junk Folder
I tried a test simulation that only went to me. However, it went to my junk folder. I didn't see anything in the Attack Simulation documentation about whitelisting and assumed that, since it is all going through Microsoft products, it would just work. Are there other steps I need to have the simulations go to users' mailboxes?
Office 365 Defender Phishing Simulation - No Templates
A couple of months ago we upgraded from E3 plan to E5 plan. My understanding is the E5 Plan gives us full access to Office 365 Defender Phishing Simulation & Training. Using a global admin account, if I try to setup a simple policy for a Credential Simulation Attack in my org there is not a single pre-configured template displayed to use for this :-(. Basically no templates anywhere, only training videos. Does anyone know what causes no templates to show in a O365 tenant? When I work through the MS training videos they shows plenty of example templates to choose from without having to resort to designing your own. There is a thread on a Sophos forum about a year ago suggesting Microsoft may have taken all the Templates away due to some copyright issue. Some others have suggested they couldn't see them due to a setup issue on their tenant or it was a problem after they migrated from a 90 trial. Grateful if anyone can shed any light on this. Thanks in advance
DMARC, DKIM, SPF none but Composite authentication pass
Hi all, I have a email where DMARC, DKIM, SPF are marked as None, but still Composite authentication as passed. How can this be since the info of the composite authentication says: Combines multiple types of authentication such as SPF, DKIM, DMARC, or any other part of the message to determine whether or not the message is authenticated. If all three are none, what other part of the messages lets the message to pass composite authentication?
Advanced Delivery for third party phishing attack scenario
Hello MSFT Team, Normally every quarterly we perform the third party phishing attack simulator in the Organization to educate the end user's but this time all the phishing testing emails are getting quarantined by marking as high phishing. After searching on the google found below link to use O365 advanced delivery policy for third party phishing. In the advanced delivery policy we have added: Domain : added sending domain Sending IP : added sending IP Simulation URLs to allow : added simulation URLs as well https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/configure-advanced-delivery?view=o365-worldwide&source=docs Followed the above msft blog and added the rule successfully but still the testing phishing emails are getting quarantined and marked as high phish. But one thing has been observed that third party phishing simulator is hosted on amazonses.com and sending domain is different but we have added only the sending domain. Do I need to add the amazonses.com domain as well in advanced delivery policy. Please can someone shed some light on it as I searching lot of blogs on advanced delivery policy but found nothing. Any help really appreciated. Regards Anand SunkaSafe attachments and encrypted or password protected attachments
I'm looking for information of how Safe Attachments in Defender for Office 365 deals with attachments that are password protected or encrypted. I can't find anything documented by Microsoft on this scenario. Does anyone have this information at all?Blocking International Countries
We have a conditional access policy that logs off accounts after 5 failed attempts. We also have an international policy blocking all international countries and IPs. unfortunately, these attempts on our accounts happen before our international blocks. I have spent way too much time with Msoft support to get nowhere. Does anyone know how to just block even the attempt of logging on from international countries?
Recent Blogs
- We are pleased to announce that Microsoft Defender for Office 365 now features large language model (LLM)-powered responses within the submission workflow. This update provides security and Exchange ...Jul 01, 2025
