Event banner
Event details
In Microsoft Defender, we are currently using the Standard Preset Policy for Threat protection, and already have the Defender of Office 365 and Impersonation protections included.
We are interested in trying Defender for Office 365 Plan 2 to try out automated email threat remediation and attack simulation, but are unsure which options we need to start using. We are prompted to start with Auditing or Blocking mode. Since we already have the Standard Preset Policy enabled and working, will starting in Audit mode turn that off? Or should we start in Blocking mode?
So, couple recommendations from my SME: recommend starting with Audit mode… and leveraging our migration and operationalization guides: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/migrate-to-defender-for-office-365-prepare?view=o365-worldwide, https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/mdo-sec-ops-guide?view=o365-worldwide
- Hi Nick, haven't forgotten about you and your question, just been trying to locate the right SME. I should have something for you shortly.
