Forum Widgets
Latest Discussions
Passkey Sign in Method (Entra Account) missing in Security
Hi Microsoft Support we enable FIDO2 passkey in entraId. However, when we try to register the FIDO2 passkey on myaccount.microsoft.com -> Security -> Add a Sign-in Method -> Passkey is missing. Attached screenshot. For a personal account, the Passkey method is available at the same location, even though interface is slightly different than an Entra Id account. Attached screenshot for the personal account as well. Kindly guide us on where to register the passkey or if we need to enable certain settings in EntraId for the passkey to show up in sign-in methods. We have Auth Strengths enabled in EntraId for the particular user in question and this reflects in the Device Lockscreen during login on Entra Registred Device. Thanks ChandraSolvedchandraOMay 25, 2026Copper Contributor177Views0likes3CommentsURL Hyperlinking phishing training
Mi using the Defender phishing simulations to perform testing. When creating a positive reinforcement email that goes to the person you have the option to use default text or put in your own text. When I put in my own text I have lines in the text, but when it renders the lines are not displayed so it looks like a bunch of text crammed together. Any idea how to get these lines to display?Solvedlfk73Feb 19, 2026Brass Contributor215Views0likes3CommentsURL rewriting does not apply during Attack Simulation (Credential Harvesting)
I’m running a credential-harvesting attack simulation in Microsoft Defender for Office 365, but the URL rewriting does not work as expected. In the final confirmation screen, the phishing link is shown as rewritten to something like: https://security.microsoft.com/attacksimulator/redirect?... However, during the actual simulation, the link is NOT rewritten. It stays as the original domain (e.g., www.officentry.com), which causes the simulation to fail with an error. I’m not sure whether this behavior is related to Safe Links or something else within Defender. Why is the URL not rewritten at runtime, and how can I ensure that the redirect link is applied correctly in the actual simulation?SolvedHOhtaniJan 28, 2026Copper Contributor273Views0likes1CommentWhat are the prerequisites to see Microsoft Secure Score?
My teammate says that even Basic or Standard M365 license provides Secure Score. Which is kind of right as you can see a basic score when opening a tenant in Lighthouse. But if you try to go to Defender console and then Exposure menu and press on Secure Score, it won't load with just Standard/Basic licenses assigned to users. I have tried to find a definitive list, but i can't. Copilot said you need at least Premium Business or E3/E5 or Defender P1. Which seems to make sense. But i need a confirmation. And also why do i see some score on tenant's page in Lighthouse?Solved1.2KViews0likes11CommentsDefender email audit - sensitive info in subject line
We are doing security auditing of emails. I'm familiar with the Defender portal, not too in-depth though (have not had time to play around) and not so with Sentinel or KQL yet. In the course of my audits, I have been finding people may encrypt emails but still have sensitive information in the subject line. Common understanding that internal emails would not leave the org so encryption is not mandatory (though I have disagreement on that). So auditing emails going external. In M365 Defender >> Email & Collaboration >> Explorer section, I did a search: keyword: "SSN" sender domain: equals my org recipient domain: equals non of my org What are some sensitive information keywords or phrases in the subject line searches in M365 Defender (security.microsoft.com)? So far I have compiled this list to (sucks M365 Defender does not allow searching with wildcards or patterns): SSN social security TIN DOB account acct passport license DLSolvedHathMHSep 08, 2025Copper Contributor151Views0likes1CommentWant to earn an Exclusive Security Tech Community Badge? Take our quick survey!
Hey there Security Tech Community! As we prepare for Microsoft Ignite, we’re building a focused, practitioner-led security roundtable and we want your input to ensure it reflects the most relevant and pressing topics in the field. We invite you to take a short survey and share the security topics, trends, and technical questions you want to see covered. Your input will directly influence the structure and substance of the Ignite Security Roundtable. The first 5 people to post a screenshot for proof of survey completion in the comments below will receive this "Microsoft Security Star" Badge to add to their Tech Community profile! TAKE THE SURVEY NOW: https://aka.ms/IgniteSecurityRoundtableSurvey2025SolvedTrevorRusherAug 15, 2025Community Manager361Views3likes6CommentsAnonymous IP address involving one user
Hello, I get security messages from M365 Defender: Sign-in from an anonymous IP address (e.g. Tor browser, anonymizer VPNs) one service user (only SMTP Auth user) is attacking by one ip address and its allways the same IPV4 address from outside. It is possible to block this ip address? I've tried with conditional access, Connection filter policy (Default) under antispam policy, but nothing helps. I've set my own public ip in conditional access and connection filter policy and try if i can use this smtp account to send mails from 3rd party tools and still works. I have no idea how can i block/reject incoming inquire from public ip adresses. Somebody can help? PeterSolvedGodCordialAug 13, 2025Copper Contributor325Views0likes2CommentsEmail notifications for risky sign-ins when user confirmed MFA
We had an incident where user's credentials were compromised, attacker logged in from another country and the user accepted MFA notification (Microsoft Authenticator). We didn't see alert in Defender, most likely because the user confirmed MFA prompt and we would like to receive email alerts in cases like this. So, interactive logins from an unfamiliar/foreign IP where user is tricked into accepting MFA prompt. Is this possible?SolvedMightyJay44Jul 01, 2025Copper Contributor118Views0likes1CommentLow reputation
I am an independent developer, and I've been unable to publish https://github.com/teamatica on the Microsoft Store for about https://teamatica.org/history-en.txt — it keeps getting rejected due to "10.2.10 Security": I realize this is because I'm not well-known, but how can I build a reputation when it’s impossible? Microsoft blocks the download: Microsoft even prevents it from being opened: Sure, I could provide a step-by-step guide on https://teamatica.org/check-digital-signature-dark-en.gif my app, but, as experience has shown, users don’t trust unfamiliar apps (and rightly so!), because Microsoft has conditioned them for years to avoid running unknown software: "Make sure you trust before you open it" and "Running this app might put your PC at risk". Don't get me wrong: as a regular user, I fully support these security measures because they truly work and help. But as an independent developer, I don’t know what to do :( My app doesn't engage in cryptojacking, doesn't initiate unauthorized network activity, and https://app.any.run/tasks/0faaf878-0f1f-49fc-a6a4-2c197bd9ac48 to users — it doesn't transmit any data to me and/or third parties, doesn't use telemetry and/or monitoring tools, doesn't track actions and/or location, doesn't have built-in diagnostics and/or analytics, doesn't request privilege escalation, doesn't collect statistics and doesn't learn from personal data. My app passes all the necessary https://www.microsoft.com/en-us/wdsi/filesubmission: And I can’t afford an https://ssl.com/faqs/which-code-signing-certificate-do-i-need-ev-ov/ since I’m an individual, not an organization: But my app gets blocked anyway. So... does anyone have any ideas on what I can do in my situation?SolvedknMar 23, 2025Brass Contributor523Views0likes3CommentsMicrosoft Security Fun Friday Week 5! This week's game- Spot the Phish!
Hey there Security Tech Community! We're back with Week 5 of our Security Fun Fridays. This week's game is Spot the Phish! Phishing is a very common cyberattack that typically targets emails and lures victims to click phony hyperlinks that share their personal information. Below I will post 3 screenshots of example Phishing Attacks and I want you to identify the most OBVIOUS ISSUE in each one. The first 2 people to respond in the comments with all 3 correct answers will earn our new "Microsoft Security Star" Badge to add to their profile. I will give everyone until Wednesday 3/19 to guess before I reveal the correct answers and award the badges (so even if 2 people answer before you, they may not be correct). Good luck! Note: This badge is only given out during Fun Friday games or by being an outstanding member of the community, so it is very exclusive! SPOT THE PHISH!SolvedTrevor_RusherMar 14, 2025Community Manager454Views0likes4Comments
Tags
- cloud security989 Topics
- security783 Topics
- microsoft information protection520 Topics
- azure499 Topics
- information protection and governance486 Topics
- microsoft 365421 Topics
- microsoft sentinel346 Topics
- azure active directory240 Topics
- data loss prevention218 Topics
- microsoft 365 defender173 Topics