Forum Discussion

John Haverty's avatar
John Haverty
Iron Contributor
Jan 31, 2018
Solved

Advanced Threat Protection Looking for Reviews

We are looking at possibly adding Advanced Threat Protection. It sounds as though it is free for our students if we add it for our faculty/staff. Does it do a good job of blocking spam, phishing, etc...
microsoft 365
security
  • Javier Urdanivia's avatar
    Javier Urdanivia
    Mar 28, 2018

    Thanks David. I also think that with the spoof intelligence feature and low false positive quarantine feature I read in another posts, ATP has improved from beginning of last year.

    There is another solution Mimecast that i am evaluating and i find it superior but the cost is also higher (3.5x) compared with Microsoft ATP. I also wondering if having another vendor solution in the middle would make us be hybrid and not officially supported by Microsoft if we ever face an issue with e-mails. 

David Levine's avatar
David Levine
Brass Contributor
Feb 09, 2018

ATP has worked pretty well for us. We added it mostly to combat zero-day malware and ransomware, which has been effective (no ransomware since enabled). I don't think ATP does anything for other spam or junkmail though. It is just a sandbox service that detects (and removes) malicious attachments / weaponized documents, etc.

John Haverty's avatar
John Haverty
Iron Contributor
Feb 09, 2018
We activated the trial for ATP. We targeted some accounts that have been repeat offenders and then our accounts too. So far no issues. I have noticed my junk mail has dropped considerably. I typically would have 10 - 15 messages in my junk folder each day and since implementing ATP on Tuesday or Wednesday this week, that number is more like 2 - 3 a day. Have not checked logs to see if it is filtering or archiving more messages, but so far liking what I am seeing.

John
  • Javier Urdanivia's avatar
    Javier Urdanivia
    Copper Contributor
    Mar 28, 2018

     

    What about E-mail delays? Have you tested average time with ATP with safe attachments ON?

    How does the Safe link feature works for you? now that Microsoft rewrites the links and you cannot hover over to see what it is?

     

    Thanks,

    Javier

    • John Haverty's avatar
      John Haverty
      Iron Contributor
      Apr 10, 2018

      Javier,

       

      We have not tested average time with ATP set up. I know I have noticed there is a slight delay, but I would say no more than a minute or two extra. As you mentioned, it does change the URL in email messages to a Microsoft site. No issues with that process either.

       

      Sorry, I was away from forums for a bit and catching up....

       

      John

       

    • David Levine's avatar
      David Levine
      Brass Contributor
      Mar 28, 2018

      Safe Attachments - as with any sandboxing solution, there is a delay with email delivery when attachments are present. For us, its been anywhere up to a minute or two at the most. ATP's performance has improved quite a bit over the past few years, so no complaints on that here.

      For Safe Links - I honestly have not really noticed much from it. While it may help and block access to malicious or compromised sites at some point, its not something I have seen in action over the past few years as I have Safe Attachments. Right now, the biggest thing I have to contend with on Safe Links is that the rewritten URL can make it difficult for end users to spot a spammed link. 

      We happen to use KnowBe4 for security awareness training efforts, and their material (as most other material I have seen in this arena) talks about how to spot spammed or spoofed email - and hovering over links to see where they actually point is always recommended. With Safe Links rewriting the URL's, it makes it harder to spot the target.

      • Javier Urdanivia's avatar
        Javier Urdanivia
        Copper Contributor
        Mar 28, 2018

        Thanks David. I also think that with the spoof intelligence feature and low false positive quarantine feature I read in another posts, ATP has improved from beginning of last year.

        There is another solution Mimecast that i am evaluating and i find it superior but the cost is also higher (3.5x) compared with Microsoft ATP. I also wondering if having another vendor solution in the middle would make us be hybrid and not officially supported by Microsoft if we ever face an issue with e-mails.