Forum Widgets
Latest Discussions
Defender email audit - sensitive info in subject line
We are doing security auditing of emails. I'm familiar with the Defender portal, not too in-depth though (have not had time to play around) and not so with Sentinel or KQL yet. In the course of my audits, I have been finding people may encrypt emails but still have sensitive information in the subject line. Common understanding that internal emails would not leave the org so encryption is not mandatory (though I have disagreement on that). So auditing emails going external. In M365 Defender >> Email & Collaboration >> Explorer section, I did a search: keyword: "SSN" sender domain: equals my org recipient domain: equals non of my org What are some sensitive information keywords or phrases in the subject line searches in M365 Defender (security.microsoft.com)? So far I have compiled this list to (sucks M365 Defender does not allow searching with wildcards or patterns): SSN social security TIN DOB account acct passport license DLSolvedHathMHSep 08, 2025Copper Contributor51Views0likes1CommentWant to earn an Exclusive Security Tech Community Badge? Take our quick survey!
Hey there Security Tech Community! As we prepare for Microsoft Ignite, we’re building a focused, practitioner-led security roundtable and we want your input to ensure it reflects the most relevant and pressing topics in the field. We invite you to take a short survey and share the security topics, trends, and technical questions you want to see covered. Your input will directly influence the structure and substance of the Ignite Security Roundtable. The first 5 people to post a screenshot for proof of survey completion in the comments below will receive this "Microsoft Security Star" Badge to add to their Tech Community profile! TAKE THE SURVEY NOW: https://aka.ms/IgniteSecurityRoundtableSurvey2025SolvedTrevorRusherAug 15, 2025Community Manager193Views3likes6CommentsAnonymous IP address involving one user
Hello, I get security messages from M365 Defender: Sign-in from an anonymous IP address (e.g. Tor browser, anonymizer VPNs) one service user (only SMTP Auth user) is attacking by one ip address and its allways the same IPV4 address from outside. It is possible to block this ip address? I've tried with conditional access, Connection filter policy (Default) under antispam policy, but nothing helps. I've set my own public ip in conditional access and connection filter policy and try if i can use this smtp account to send mails from 3rd party tools and still works. I have no idea how can i block/reject incoming inquire from public ip adresses. Somebody can help? PeterSolvedGodCordialAug 13, 2025Copper Contributor131Views0likes2CommentsEmail notifications for risky sign-ins when user confirmed MFA
We had an incident where user's credentials were compromised, attacker logged in from another country and the user accepted MFA notification (Microsoft Authenticator). We didn't see alert in Defender, most likely because the user confirmed MFA prompt and we would like to receive email alerts in cases like this. So, interactive logins from an unfamiliar/foreign IP where user is tricked into accepting MFA prompt. Is this possible?SolvedMightyJay44Jul 01, 2025Copper Contributor93Views0likes1CommentLow reputation
I am an independent developer, and I've been unable to publish https://github.com/teamatica on the Microsoft Store for about https://teamatica.org/history-en.txt — it keeps getting rejected due to "10.2.10 Security": I realize this is because I'm not well-known, but how can I build a reputation when it’s impossible? Microsoft blocks the download: Microsoft even prevents it from being opened: Sure, I could provide a step-by-step guide on https://teamatica.org/check-digital-signature-dark-en.gif my app, but, as experience has shown, users don’t trust unfamiliar apps (and rightly so!), because Microsoft has conditioned them for years to avoid running unknown software: "Make sure you trust before you open it" and "Running this app might put your PC at risk". Don't get me wrong: as a regular user, I fully support these security measures because they truly work and help. But as an independent developer, I don’t know what to do :( My app doesn't engage in cryptojacking, doesn't initiate unauthorized network activity, and https://app.any.run/tasks/0faaf878-0f1f-49fc-a6a4-2c197bd9ac48 to users — it doesn't transmit any data to me and/or third parties, doesn't use telemetry and/or monitoring tools, doesn't track actions and/or location, doesn't have built-in diagnostics and/or analytics, doesn't request privilege escalation, doesn't collect statistics and doesn't learn from personal data. My app passes all the necessary https://www.microsoft.com/en-us/wdsi/filesubmission: And I can’t afford an https://ssl.com/faqs/which-code-signing-certificate-do-i-need-ev-ov/ since I’m an individual, not an organization: But my app gets blocked anyway. So... does anyone have any ideas on what I can do in my situation?SolvedknMar 23, 2025Brass Contributor388Views0likes3CommentsMicrosoft Security Fun Friday Week 5! This week's game- Spot the Phish!
Hey there Security Tech Community! We're back with Week 5 of our Security Fun Fridays. This week's game is Spot the Phish! Phishing is a very common cyberattack that typically targets emails and lures victims to click phony hyperlinks that share their personal information. Below I will post 3 screenshots of example Phishing Attacks and I want you to identify the most OBVIOUS ISSUE in each one. The first 2 people to respond in the comments with all 3 correct answers will earn our new "Microsoft Security Star" Badge to add to their profile. I will give everyone until Wednesday 3/19 to guess before I reveal the correct answers and award the badges (so even if 2 people answer before you, they may not be correct). Good luck! Note: This badge is only given out during Fun Friday games or by being an outstanding member of the community, so it is very exclusive! SPOT THE PHISH!SolvedTrevor_RusherMar 14, 2025Community Manager272Views0likes4CommentsMicrosoft Security Fun Friday Week 4! This week's game- FACT OR FICTION
Hey there Security Tech Community! We're back with Week 4 of our Security Fun Fridays. This week's game will be Fact or Fiction! Below are FIVE statements related to cybersecurity and it is up to YOU to determine whether the statements are Facts (true) or Fiction (false). The first THREE people to respond below in the comments with all five correct answers will earn our new "Microsoft Security Star" Badge to add to their profile. I will give everyone until TUESDAY 2/25 before I post the answer key and award the badges (so even if 3 people answer before you, they may not be correct). Good luck! Note: This badge is only given out during Fun Friday games or by being an outstanding member of the community, so it is very exclusive! STATEMENTS: An organization has deployed Microsoft 365 applications to all employees. Per the shared responsibility model, Microsoft is responsible for the accounts and identities relating to these employees. Data sovereignty is the concept that data, particularly personal data, is subject to the laws and regulations of the country/region in which it's physically collected, held, or processed. Multifactor authentication works by requiring a user to provide multiple forms of identification to verify that they are who they claim to be. The Zero Trust model operates on the principle of “constantly be collecting information about your systems, vulnerabilities, and attacks.” Wardriving is the name of a common network attack where the cybercriminal compromises a router in the network to eavesdrop on, or alter, data.SolvedTrevor_RusherFeb 21, 2025Community Manager301Views0likes6CommentsMicrosoft Security Fun Friday Week 2! This week's game- Security Crossword.
Hey Tech Community! We're back with Week 2 of our Security Fun Friday. The first to complete and post a screenshot in the comments of today's Security-themed Crossword Puzzle will earn our new "Microsoft Security Star" Badge to add to their profile! This badge will only be given out during these Fun Friday games or by being an outstanding member of the community, so it will be very exclusive! Also just like last week, if you have any ideas of other fun games that you would like to see in the future, please comment below. Good luck and happy solving!SolvedTrevor_RusherFeb 07, 2025Community Manager166Views0likes3CommentsDLP Policy Tip Stopped Working in SharePoint/OneDrive
Greetings, I created a DLP policy in Microsoft Purview several years ago to display a policy tip to users and it has been working until recently. No changes have been made to the policy. Now, when I go to a SharePoint document library, whether I hover on a sensitive document to see the "View policy tip" or select on the details pane, I no longer see the policy tip information. If I try to share the sensitive document, I also see the "View policy tip". However, this time it shows a Policy tip details dialog box "Policy tip couldn't be displayed. Please try again." Has anyone seen this? Could you share the solution to fix it? Thanks!SolvedVee_MaxDec 10, 2024Brass Contributor223Views0likes1CommentRollout Windows hello for Business
Hello, I would like to roll out Windows Hello for Business (cloud trust). The configuration with Endpoint Manager is complete. Everything works very well for new installations. There are problems with clients with activated Windows Hello (without Business). The only option here is to delete the Windows Hello configuration and then log on to the client with TPA. Windows Hello for Business can then be configured. Is there a better way to configure it for existings cliens with active windows hello (without Business)? If the user first login with password the PIN create runs in a timeout with the information it needs more secure informaton. The user has no MFA configured. Thanks for your help StefanSolvedStefanKiOct 19, 2024Iron Contributor685Views0likes5Comments
Resources
Tags
- cloud security982 Topics
- security764 Topics
- microsoft information protection517 Topics
- azure497 Topics
- information protection and governance483 Topics
- microsoft 365416 Topics
- microsoft sentinel337 Topics
- azure active directory240 Topics
- data loss prevention212 Topics
- microsoft 365 defender166 Topics