Event banner
Event details
- Heather_Poulsen
Community Manager
Here are the resources mentioned and listed at the end of this session:
- Blog post - Protect passwords with enhanced phishing protection
- IT admin information - Enhanced Phishing Protection in Microsoft Defender SmartScreen
- Consumer information - Protect your Microsoft password from being phished
- Policy/CSP information - Policy CSP - WebThreatDefense
- Security toolkit - Windows 11, version 22H2 security baseline
- SmartScreen information - Microsoft Defender SmartScreen overview
- I saw an earlier reply that this feature was only available on Win 11 22H2, but I have Win11 21H2 installed and appear to see the phishing protection options available. Is it the same feature?
- Sinclaire_Hamilton
Microsoft
What phishing protection options do you see available, and where on your device? (A screenshot would be helpful).Here is a screenshot, thanks! This is in Windows Security, Reputation-based protection, and I'm on 21H2.
- MichaelHildebrandDoes the protection block the cred from being sent to the phishing site/malicious code or does it allow it, then alert? The UI indication looks like it blocks it - but there is a UI element prompting to change the user's password. Why would I need to change the password if it wasn't sent?
- Sinclaire_HamiltonThe Enhanced Phishing Protection UI prompts users to change their password because it pops up right after typed password entry is detected, regardless of whether or not the user has pressed "enter" or "sent" the password.
- MichaelHildebrandThanks Sinclaire! 🙂
- Can we get all those links at the end there?
- Heather_Poulsen
- If a legitimate logon prompt keeps flagging as unsafe, when actually it isn't, is there a way to add the system to a whitelist?
- Sinclaire_HamiltonEnhanced Phishing Protection is powered by SmartScreen, so if there is a false positive you would remediate the issue by submitting a FP response to SmartScreen.
- Heather_Poulsen
We’re happy you’re here with us at the Microsoft Technical Takeoff! Whether you are attending one session or many, please take this 2-minute survey and let us know your thoughts on this event.
Also, while we’ll continue to answer questions here in the chat for the rest of this half hour, we’ll also check back throughout the week so keep your questions coming! We're here to help! And, for bonus content, make sure to check out our Technical Takeoff Demo Channel!
- Does this only protect the account that was used to logon to the device? Or will it also protect any additional AAD acct used? Use case would be people using separate "secured" accounts to access Intune/Azure portals...
- Sinclaire_HamiltonEnhanced Phishing Protection only protects the AAD, MSA, AD, or local account used to log into the Windows 11 device. It will not protect any additional secondary or associated AAD accounts that are not used to log into the device itself.
- Does this work for any website or just for Office.com
- Sinclaire_HamiltonThis works for any website because our feature is integrated directly into the Operating System. That means we are able to warn users against unsafe password entry (i.e. entry into a phishing site or password reuse) on any app or site on Windows 11. The unsafe password storage scenario only warns against plaintext passwords typed into Notepad, Office Apps, and Wordpad.
- Is this feature independent of the browser the end user is using? For example, if a user is not using Edge but instead Google Chrome?
- Sinclaire_HamiltonEnhanced Phishing Protection works independent of the browser the end user is using! We work in all apps and sites, including Edge and Google Chrome.
- Sinclaire_HamiltonWelcome everyone!! I'm looking forward to this Technical Takeoff Session - I'm here live to answer any questions you may have about Enhanced Phishing Protection.
