rss.livelink.threads-in-node

Defending the Inbox Against Prompt Injection Attacks

nithinnara — Wed, 08 Jul 2026 18:16:22 GMT

AI assistants are quickly becoming part of everyday work—summarizing emails, drafting responses, triaging requests, and even potentially acting across connected business systems. As email becomes an automated input to AI systems, it can also become a new attack surface. Attackers no longer need to convince a human to click; they can target the AI. This shift changes how email threats operate and why traditional protections aren’t enough on their own. Publicly disclosed research—Morris II, EchoLeak, and a steady stream of indirect prompt injection findings—shows this isn’t theoretical. Email can be the highest-volume, lowest-friction ingress channel into your AI estate, and it needs its own purpose-built control.

Today, we’re announcing a new capability in Microsoft Defender that addresses this. Microsoft Defender can now detect and isolate malicious AI instructions embedded in email, commonly referred to as prompt injection, before delivery. This reduces the risk of prompt injection reaching the inbox and activating against AI systems. By detecting these threats, organizations are better protected from prompt injection-driven compromise and unintended data exposure.

Rather than responding to attacks after an AI system has already processed them, Defender can remove the threat at the earliest control point: the inbox itself.

When attackers stop phishing humans and start targeting AI

For decades, email attacks relied on social engineering—convincing a user to click a link, open an attachment, or follow instructions. AI assistants connected to email change that model.

For illustrative purposes, an attack chain could look like this:

An attacker can send an email containing hidden instructions often invisible to a human because they’re encoded, white-on-white, zero-width Unicode, or embedded in HTML the renderer hides.
The recipient, or an autonomous agent, asks Copilot to summarize or process the unread mail or inbox.
The AI could unknowingly follow the embedded instructions, which can trigger actions like exposing sensitive data, calling tools, or poisoning downstream context.

This emerging class of attack, commonly referred to as indirect prompt injection, represents a clear evolution of email‑borne risk and calls for protections specifically designed for AI‑targeted threats.

How Microsoft Defender protects against prompt injection attempts

Protection against prompt injection is built into Defender’s existing email security pipeline, allowing organizations to reduce AI-targeted threats without requiring new tools, workflows, or operational complexity.

Helps stop attacks before delivery – Malicious AI instructions embedded in emails can be detected and quarantined before they reach the inbox.
Reduces downstream AI exploitation – By blocking these messages at ingress, prompt injection attempts are less likely to become available to Copilot, Microsoft 365 agents, or any AI tool grounded in Exchange Online data.
Starts working automatically – For eligible customers, protection is enabled by default, allowing security teams to benefit without policy changes or admin opt-in.

How to view detections

Detections are classified under the existing High Confidence Phish verdict with a new Detection Technology value: Prompt Injection Protection.

Analysts will be able to interact with this experience across familiar Defender surfaces:

Email Quarantine – Messages containing detected prompt injection are isolated before delivery, with the relevant detection technologies visible as part of the message details.

Explorer and email entity pages – Analysts can review the full message context, investigate why it was flagged, and understand how the threat fits within the broader email investigation flow.

Securing the AI data perimeter

Email can be the first, and highest-volume, entry point into AI systems, making it a critical control plane for preventing AI-driven compromise. But email is only the beginning. As AI systems increasingly interact with documents, collaboration platforms, and third‑party data sources, protecting the AI data perimeter becomes critical. Detecting and blocking prompt injection at the inbox represents an important step toward that future—where Defender can stop AI‑targeted threats wherever untrusted data meets autonomous systems. As the threat landscape continues to evolve, Defender is designed to evolve with the threat landscape, so organizations can deploy AI more securely while helping reduce new attack risks.

Get started

Prompt injection protection is now in Public Preview. For eligible customers, protection is enabled automatically without requiring policy changes or additional configuration. To learn more about this feature, visit our documentation.

Microsoft Defender (GCC) - User Submitted "Mark and Notify" for Third Party Phishing Simulations

GalgoArmy — Thu, 25 Jun 2026 16:03:00 GMT

Our Microsoft 365 tenant is in the GCC environment, and we use a third party phishing simulation platform along with the built in Outlook Report Message button (not a third party reporting add in).

When a user correctly reports one of our simulated phishing emails, the message appears in Microsoft Defender > User Submitted as expected.

The problem is what happens next.

When we select Mark and notify, the only available options are:

Phishing

Spam

No threat found

There is no option to notify the user that the email was actually part of a phishing simulation.

This creates a difficult situation:

If we choose No threat found, Defender tells the user the message was safe, making it appear they incorrectly reported the email even though they did exactly what we trained them to do.

If we choose Phishing, the user receives the correct feedback, but the message is counted as a real phishing event, affecting our Defender metrics and potentially generating false incidents and reporting.

It feels like we're stuck in a design loop where neither option provides the desired outcome.

My questions are:

Is there a supported way in Microsoft Defender (particularly GCC) to notify users that a reported message was a simulated phishing email when using the native Outlook Report Message button?

Is this capability available in Commercial tenants but not GCC, or is it unavailable across all environments?

If this functionality does not exist, what is the recommended process for submitting a feature request specifically for the GCC version of Microsoft Defender? This seems like a valuable enhancement for organizations that use third party phishing simulation platforms while relying on Microsoft's native reporting experience.

Has anyone else found a good workflow for this scenario?

Microsoft Defender for Office 365 Plan 1 is now rolling out to Microsoft 365 E3 and Office 365 E3

VipulPandey — Thu, 18 Jun 2026 16:29:24 GMT

Starting today, Microsoft Defender for Office 365 Plan 1 is rolling out to customers with Microsoft 365 E3/G3 and Office 365 E3/G3 licenses, with rollout expected to complete by Fall 2026. For security teams, this means added protection against phishing, malware, and malicious links across email and collaboration, without needing to purchase or deploy a separate email security solution. It also means some protections will turn on automatically, so now is the right time to review your configuration and prepare for any changes to mail flow, policies, and end-user experience.

What E3 customers are getting

Previously, these subscriptions included built-in security to help filter spam and known malware. Defender for Office 365 Plan 1 builds on that foundation with additional protections designed to catch more sophisticated phishing attempts, malicious links, and zero-day threats, while giving your team better visibility into what is happening in your environment.

Safe Links: Helps protect users with time-of-click protection by checking URLs and blocking malicious destinations, including QR code-based attacks.
Safe Attachments: Helps stop unknown and zero-day malware before harmful files reach users.
Advanced anti-phishing: Helps detect impersonation attacks that target your users, executives, and trusted domains.
Expanded visibility and reporting: Gives security teams more actionable detections, alerts, and reporting in the Microsoft Defender portal.

What changes automatically

As the plan rolls out, protection will turn on automatically for licensed users. That is good news from a security perspective, but it is still important to understand what is changing in your environment. New protections can affect how messages are processed, how suspicious links are handled, what users see when they click blocked content, and how your team monitors and tunes policy settings after rollout.

Read more about it here: https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies#use-the-microsoft-defender-portal-to-add-exclusions-to-the-built-in-protection-preset-security-policy.

How to prepare for the rollout

Review your current mail flow and security configuration. If you know how mail is routed today and which protections are already in place, it will be easier to spot what changes once Defender for Office 365 Plan 1 is active.
Decide how you want to manage policies. When the plan becomes available in your tenant, built-in protection is applied automatically for licensed users. If you want Microsoft recommended settings beyond that baseline, consider enabling the Standard or Strict preset security policies.
Prepare your help desk and users. Users may start seeing warning or block experiences when Safe Links identifies a malicious destination. A simple heads-up can reduce confusion and support tickets. For more details and how to customize user notification, see Set up Safe Links policies.
Plan for exceptions and tuning. If you have specific users, domains, or workflows that need exclusions, review those requirements early so your team is ready to adjust policies after rollout.
Monitor what changes. Use the Microsoft Defender portal and Microsoft Secure Score to track new detections, review improvement actions, and prioritize follow-up configuration work.

If you use a third-party secure email gateway

If your organization routes email through a third-party secure email gateway such as Proofpoint, Mimecast, or Barracuda before it reaches Microsoft 365, you should review your configuration now. In many environments, it is recommended to configure Enhanced Filtering for Connectors, preserve original sender details in Exchange Online, and decide which service will handle link rewriting to avoid unnecessary overlap. If you are evaluating a broader consolidation of your email security stack, our guides on defense in depth and migration to Defender for Office 365 can help.

Protection also extends to Microsoft Teams

The plan also extends protection to Microsoft Teams chats and channels. That includes protection for shared links and files, post-delivery removal of malicious content, admin controls to manage enforcement, and user reporting to help your security team investigate suspicious messages faster. For practitioners, this adds another layer of coverage across the collaboration tools users rely on every day.

Learn more

For implementation guidance, visit the Microsoft Defender for Office 365 security documentation, review the step-by-step guides, and use the preset policy, defense in depth, migration, and connector configuration resources linked above to plan your rollout.

No way to automate restoring user‑reported emails after “no threats found”

GT_deb — Thu, 04 Jun 2026 17:30:51 GMT

When a user reports an email as phishing in Defender, the message gets moved to Deleted Items. After we triage it, if we mark it as “no threats found,” there’s no way to push it back to the user’s inbox as part of that workflow.

That creates a bit of a broken experience:

User is told the email is safe with our customized email response, but has to go find it themselves
In a lot of cases they don’t (Outlook search won’t find it)
We end up with follow‑ups like “where did it go?”

Technically we could restore the email as part of our triage process, but that just shifts the effort onto the SOC. It doesn’t scale, and it’s not really the right place for that work. We have tried to create an automation to do this, but we have not been able to create an advanced hunting query based on our triage result that can then trigger an action to restore it to the mailbox.

So we end up choosing between:

Users having a bad experience, or
Analysts doing manual mailbox work

Neither is ideal.

Other platforms (like Proofpoint) handle this end‑to‑end — once something is confirmed clean, it can be returned to the user automatically.

Right now Defender stops at classification instead of completing the workflow.

Is there a reason this isn’t wired in, or anything on the roadmap to address it?

Granular email content access with unified RBAC – now the default for new Defender tenants

VipulPandey — Wed, 29 Apr 2026 16:00:00 GMT

Email investigations are a key part of detecting and responding to phishing and malware. As security workflows continue to evolve, there is an increasing need to align email content visibility more closely with specific roles and scenarios, such as Tier‑1 analysis or specialized workflows like user‑reported phishing triage.

Today we’re announcing additional “read-only” controls for more granular email access in Microsoft Defender and that starting on May 30^th, 2026, unified RBAC will become the new default for permission modeling for new tenants.

Unified RBAC in Microsoft Defender: a single, consistent permissions model

Microsoft Defender unified role‑based access control (RBAC) provides a centralized way to manage permissions across the Defender security portfolio, replacing the need to configure and audit access separately for each solution, including endpoint, identity, SaaS, Cloud, and more. Instead of stitching together service‑specific role models, unified RBAC gives security teams one consistent authorization framework to control what users can see and do across the Microsoft Defender portal.

Unified RBAC is designed to support modern security operations by aligning access with real‑world roles, such as analysts, investigators, and administrators, while reducing the risk that comes from over‑permissioned accounts including:

Enforcing least‑privilege access consistently
Understanding who has access to sensitive data across services
Performing clean access reviews and audits
Scaling permissions safely in tiered SOC or partner‑managed environments

Unified RBAC addresses these challenges by converging permissions into a single model and separates read-only (data access) and manage (action‑taking) permissions by design, making access intent explicit and reducing accidental overexposure of sensitive security data.

More granular email permissions within unified RBAC

Unified RBAC now supports additional read‑only permissions for specific email content scenarios—so access can be matched precisely to investigation and review workflows.

1. New permission-Email & collaboration content: Emails associated with alerts

The new Emails associated with alerts permission allows analysts to preview or download emails only when they are directly associated with a security alert, without granting access to all email content. Initially, this permission applies to alerts of type Email reported by user as malware or phish and Email reported by user as junk, which is one of the most common investigation entry points for security teams. Only emails tied to that alert type can be previewed or downloaded. Support for additional alert types will expand in future updates.

Why this matters: Tier‑1 analysts and triage teams can investigate user‑reported threats quickly and effectively, without being granted visibility into unrelated emails.

2. New permission- Email and Collaboration content: Quarantine Emails

This new permission allows previewing and downloading only emails that are in admin quarantine, supporting roles responsible for reviewing or validating quarantined messages – without broader email access.

Important: After this update, Email & collaboration quarantine and Security data basics will no longer provide email content preview or download by themselves. To allow content visibility for quarantined messages, you must explicitly assign Emails in Quarantine. This change clarifies role boundaries and simplifies audits by making content access intentional and explicit. Read more here.

Why this matters: Quarantine review teams can access exactly what they need—no more, no less—supporting least-privilege access by design.

These permissions extend the Unified RBAC model for email & collaboration by separating visibility from action. They allow security teams to grant targeted access to email content only where it’s required, while preserving full content access for senior investigators and incident response teams.

Full email content access remains available through existing permissions—such as Email & collaboration content: All emails—for senior investigators and incident response teams who require unrestricted visibility.

Unified RBAC becomes the default for new Microsoft Defender tenants

Starting May 30^th, 2026, Unified RBAC will be enabled by default for new Microsoft Defender for Office 365 Plan 2 tenants, making it the primary permissions model that enables a single, unified authorization model across the Defender suite. Permissions are managed through Defender unified RBAC roles, alongside Microsoft Entra roles where applicable (e.g. for Attack Simulation Training). Making Unified RBAC the default for new tenants is a key step toward simplifying permissions management and embeds least-privilege access by design.

Learn more

Declutter and Defend: Reducing promotional mail noise with Microsoft Defender

FaithEbenezerOquong — Thu, 23 Apr 2026 03:59:21 GMT

Enterprise inboxes are overwhelmed with graymail — legitimate, bulk email like newsletters, vendor promotions, and product updates that isn't malicious but buries the messages that matter. When high volumes of these mails land in the inbox, it crowds out priority communications and can dull security vigilance. Employees conditioned to ignore repetitive emails may miss signs of a real threat. It also creates recurring work for admins and security teams who must continuously tune filters, manage exception requests, and chase noise from user reports for email that isn’t malicious. Because graymail passes every spam filter check, traditional defenses don't separate it — leaving this signal-to-noise gap unaddressed.

Today we’re excited to announce that Microsoft Defender now includes built-in graymail filtering. It is delivered natively through a new Promotions experience in Outlook that automatically classifies and separates bulk email, so it no longer competes with business-critical communication in the inbox. Now in Public Preview, this capability learns from how users interact with graymail to become more accurate over time. Coupled with the existing Bulk Senders Insight report, Defender brings data-driven bulk classification and control into the security workflows you already use.

What Is Graymail?

Graymail is legitimate bulk email that isn't malicious—product newsletters, event announcements, marketing promotions, and software update notifications from reputable, authenticated senders. It is distinct from spam and from phishing - graymail comes from real organizations with proper authentication and traditional spam filters aren't designed to handle it.

Graymail handling in Microsoft Defender

Microsoft Defender's approach is built on three principles: classify intelligently, deliver natively, and learn continuously.

Promotions Folder — Intelligent Inbox Organization

A dedicated Promotions folder, natively provisioned in Outlook, now keeps legitimate bulk mail out of the primary inbox. Promotional content is separated from priority emails without being sent to Junk, which means users can still access and browse newsletters and updates at their own pace. The folder appears at the top level of the mailbox for easy discovery and is visible across all Outlook experiences.

Non-spam bulk mail below the organization's configured Bulk Complaint Level threshold is automatically routed to the Promotions folder.
Messages from senders the user has explicitly allowed continue to land in the Inbox.
Messages identified as spam continue to go to Junk.

To enable the Promotions folder administrators need to enable the "Bulk Moves Enabled" setting in their anti-spam policy. The Promotions folder is then created for all users and used for routing only when this setting is ON.

Existing mail flow is unaffected.

Figure 1: system tagging of “Promotions” in outlook client and promotions folder (previously tagged as “Bulk” in private and public preview)

Promotional mail tagging and Mailbox Rule Support

Messages classified as graymail will automatically be labeled with a "Promotions" system tag in Outlook. The tag provides instant visual context without requiring users to open each message and is visible in Outlook on the Web and the native Outlook desktop apps for Windows and Mac. During Public Preview, the tagging component is opt-in, requiring administrators to enable it by configuring an Exchange Transport Rule. Once generally available, it will be enabled by default.

Because this classification is integrated at the client level, the Promotions tag can also be used as a condition in Outlook mailbox rules. This enables custom routing logic for advanced scenarios like moving all promotions-tagged messages from a specific sender to a custom folder, flagging certain promotional emails for follow-up, or auto-forwarding or deleting promotions that meet specific criteria. This transforms the Promotions classification from a one-way filter into a flexible building block for personal and organizational workflows—particularly valuable for power users and teams with compliance or archival requirements.

Figure 2: User inbox rules using “Promotion” tag (previously “Bulk” in private and public preview)

Adaptive Learning

Microsoft Defender's graymail filtering gets smarter with every interaction. The system learns directly from how users handle their mail. When a user moves a message out of the Promotions folder and back to the Inbox, future emails from that sender will no longer be placed in the Promotions folder. When a user moves a message from the Inbox into the Promotions folder, future emails from that sender will be routed to the Promotions folder automatically.

This creates a personalized, self-improving experience that becomes more accurate over time - no manual rule configuration required, no safe-sender lists to maintain, and no filtering rules for IT teams to manage on behalf of individual employees.

Built into existing Security Workflows

Administrators also gain visibility through the Bulk Senders Insight report, which provides data-driven guidance on what your organization actually receives and can help tune your bulk mail filtering.

Graymail has long been the unsolved middle ground of email security—too legitimate to block, too noisy to ignore. Microsoft Defender now handles it where it should be handled: inside the platform, inside the mailbox, and inside the security workflows your organization already relies on. No new portals, no new vendors, no compromise between security and user experience.

Get Started

Configure promotions tagging and the promotions folder today - Bulk email detection documentation on Microsoft Learn.
Monitor the experience using the Bulk Senders Insight report.

Enable per‑user language selection for phishing simulation emails and landing pages

POlsen — Tue, 21 Apr 2026 17:17:40 GMT

We use Attack Simulation Training to deliver phishing simulations to a global, multilingual user base. While Microsoft Defender supports multi‑language content, phishing simulation emails and landing pages are currently delivered in a single selected language per campaign.

We are requesting a feature that allows phishing simulation emails and associated landing pages (including credential‑harvest pages) to automatically render in each user’s preferred language, based on:

Outlook mailbox language settings, and/or
Microsoft Entra ID user language preferences

This capability would:

Improve realism and accuracy of phishing simulations
Ensure users experience simulations in the same language they normally work in
Improve behavioral measurement in global organizations
Reduce the need to create and manage multiple parallel simulations by language

Providing consistent, per‑user language alignment across simulation emails, landing pages, and follow‑up training would significantly enhance the effectiveness of Attack Simulation Training for large, multilingual enterprises.

Enable automatic per‑user language selection for Defender training modules

POlsen — Tue, 21 Apr 2026 17:15:09 GMT

We use Attack Simulation Training and Microsoft Defender training modules as part of our security awareness program for a global audience.

Currently, training content is assigned in a single language per campaign, even though users already have preferred language settings defined in Outlook and Microsoft Entra ID (Azure AD). This creates challenges for multinational organizations and often requires duplicating campaigns or accepting that some users receive training in a non‑preferred language.

We are requesting a capability that allows Defender training modules to automatically display in each user’s preferred language, based on:

Outlook mailbox language settings, and/or
Microsoft Entra ID user language preferences

Enabling per‑user language selection would:

Improve comprehension and learning outcomes
Increase training effectiveness for non‑native speakers
Reduce administrative overhead and duplicated campaigns
Align Defender training with existing Microsoft 365 localization behavior

Defender already supports training content in multiple languages. Allowing dynamic language delivery per user would significantly improve scalability and usability for enterprise security awareness programs.

Announcing Public Preview: Security Copilot’s Email Summary in Microsoft Defender

cristinadagamah — Tue, 14 Apr 2026 20:19:58 GMT

Co-Authors: Cristina Da Gama Henriquez and Ajaj Shaikh

AI is rapidly reshaping both sides of the security landscape, and email remains one of the most common and complex entry points for attacks. As adversaries use AI to scale more sophisticated phishing and email-based threats, defenders are under pressure not just to detect them, but to quickly understand what actually happened. Microsoft continues to apply generative and agentic AI across the email protection stack to help stop threats before they reach the inbox and catch what inevitably gets through in the SOC. Still, for security analysts, understanding an email threat requires piecing together context across the incident and its related artifacts. Much of that context exists within the Email entity experience, but it is spread across metadata, timelines, URLs, and attachments, making it time-consuming to connect the dots and act with confidence.

Today, we are excited to announce the public preview of Security Copilot’s Email summary capability, designed to bring those insights together and make email threat investigations faster, clearer, and more actionable. With Security Copilot included in Microsoft 365 E5, organizations will be able to bring AI directly into their flow of work—extending these benefits across the SOC at no additional cost.*

Bringing clarity into the investigation workflow

Email summary brings AI-generated context directly into the Email entity page, transforming fragmented detection data into a clear, natural-language explanation of what happened and why. Analysts can access it from the Security Copilot right-side pane, the same place where Copilot activity across Microsoft Defender is surfaced. Instead of navigating across multiple views to reconstruct the story, analysts can generate a summary that connects the signals and highlights what matters most. And it all happens in seconds.

Built on Security Copilot’s summarization capabilities, Email summary uses the same data analysts already rely on, like email metadata, timeline events, URLs, and attachments, and turns it into a cohesive narrative. It explains how a message was evaluated, what actions were taken, and where risk exists, without requiring manual correlation.

A summary that follows how analysts think

The experience is intentionally embedded in the Email entity page, where investigations already happen, so analysts don’t have to change how they work to benefit from it. The output is structured to match how analysts approach an investigation. It starts with a concise overview of the email, including what was detected, what actions were taken, and any key indicators. From there, it walks through the timeline of events, helping reconstruct how the email was delivered, interacted with, and remediated. It also breaks down URLs and attachments, calling out malicious signals and explaining associated risks in plain language.

Importantly, this is a user-triggered experience. Analysts generate a summary when they need it, ensuring the capability is both intentional and efficient.

From fragmented data to confident decisions

Email summary is a foundational step toward making email threat investigations more explainable and efficient. Today, it brings together existing signals into a clear, actionable narrative. Over time, it will evolve to incorporate additional signal depth: detonation (sandboxing) results, submission responses, and more granular insights from the filtering stack, further strengthening the completeness and fidelity of each investigation.

As threats continue to grow in speed and sophistication, the ability to quickly understand and act is just as critical as detection itself. Email summary helps close that gap, giving analysts the clarity they need to respond with confidence.

*Eligible Microsoft 365 E5 customers will have 400 Security Compute Units (SCUs) per month for every 1,000 user licenses, up to 10,000 SCUs per month. This included capacity is expected to support typical scenarios. Customers will have an option to pay for scaling beyond the allocated amount at a future date with $6 per SCU on a pay-as-you-go basis, and will get a 30-day advanced notification when this option is available. Learn more.

Do XDR Alerts cover the same alerts available in Alert Policies?

underQualifried — Thu, 02 Apr 2026 18:43:55 GMT

The alerts in question are the 'User requested to release a quarantined message', 'User clicked a malicious link', etc. About 8 of these we send to 'email address removed for privacy reasons'. That administrator account has an EOM license, so Outlook rules can be set. We set rules to forward those 8 alerts to our 'email address removed for privacy reasons' address. This is, very specifically, so the alert passes through the @tenant.com address, and our ticketing endpoint knows what tenant sent it. But this ISN'T ideal because it requires an EOP license (or similar - this actually hasn't been an issue until now just because of our customer environments). I've looked at the following alternatives: -

Setting email address removed for privacy reasons as the recipient directly on the Alert Policies in question. This results in the mail going directly from microsoft to our Ticketing Portal - so it ends up sorted into Microsoft tickets. and the right team doesn't get it.
SMTP Forwarding via either Exchange AC User controls or Mail Flow Rules. But these aren't traditional forwarding, and they have the same issue as above.
Making administrator @tenant.com a SHARED mailbox that we can also login to (for administration purposes). But this doesn't allow you to set Outlook rules (or even login to Outlook).

I've checked out the newer alerts under Defender's Settings panel - XDR alerts, I think they're called. Wondering if these can be leveraged at all for this? Essentially, trying to get these Alerts to come to our external ticketing address, from the tenants domain (instead of Microsoft). I could probably update Autotask's rules to check for a header, and set that header via Mail Flow rules, but.. just hoping I don't have to do that for everyone.

Impersonation Protection: Users to Protect should also be Trusted Senders

underQualifried — Thu, 02 Apr 2026 18:30:38 GMT

Hey all, sort of a weird question here. Teaching my staff about Impersonation Protection, and it's kind of occurred to me that any external sender added to 'Senders to Protect' sort of implicitly should also be a 'Trusted Sender'. Example - we're an MSP, and we want our Help Desk (email address removed for privacy reasons) to be protected from impersonation. Specifically, we want to protect the 'Help Desk' name. So we add email address removed for privacy reasons to Senders to protect. However, we ALSO want to make sure our emails come thru. So we've ALSO had to add email address removed for privacy reasons to Trusted Senders on other tenants.

Chats with Copilot have sort of given me an understanding that this is essentially a 'which is more usefuI' scenario. But CoPilot makes things up, and I want some human input.

In theory, ANYONE we add to 'trusted senders' we ALSO want protected from Impersonation. Anyone we protect from Impersonation we ALSO want to trust. Copilot says you SHOULDN'T do both.

Which is better / more practical?

I would like to know the complete list of alerts whose serviceSource is MDO

Kota2 — Tue, 31 Mar 2026 12:14:37 GMT

Hi all

In order to determine the alerts that should be monitored by the SOC, I would like to identify, from the alerts listed at the link below, those whose serviceSource is Microsoft Defender for Office 365 (MDO).

Alert policies in the Microsoft Defender portal - Microsoft Defender XDR | Microsoft Learn

I couldn’t find where this is documented, no matter how thoroughly I searched, so I would appreciate it if you could point me to the relevant documentation.

thx

From Impersonation Calls to Transparent Reporting: Defending the New Front Door of Attacks

JeffreyPinkston — Fri, 27 Mar 2026 23:13:51 GMT

Email is still a major entry point—but it’s no longer the only one that matters. Today’s attackers are increasingly shifting to collaboration channels like Microsoft Teams, where trust is implicit and interaction is real time. Decisions happen fast, and that changes the economics of attacks. Adversaries can pressure users, adapt on the fly, and accelerate their objectives before traditional controls have time to respond. They can then pivot laterally across identities, endpoints, and cloud apps.

And it’s not just chats and shared links anymore. Teams calling has emerged as a high-impact social-engineering path—a “front door” attackers can use to bypass inbox defenses. They can impersonate familiar brands or internal functions. They can also try to extract credentials or persuade a user to take immediate action. In a typical flow, an attacker leverages urgency and context. For example, they may reference an “account issue” following suspicious email activity. They then use the real-time pressure of a call to drive a user toward compromise. That’s why protection must happen directly in the collaboration experience.

At RSA 2026, we’re announcing new Microsoft Defender capabilities designed for exactly this reality. They give SOC teams visibility that matches how attacks unfold across Microsoft Teams. They also help end users easily identify impersonation attempts, so they can stop them before compromise. And we’re introducing the new Protection and Posture Insights report, which provides tenant-specific insights about your collaboration security with Microsoft Defender.

Protect your organization from voice-based attacks in Microsoft Teams

Voice phishing (vishing) is a fast-growing vector because it lets attackers bypass message-based filters and manipulate targets in real time. But security teams haven’t had the same level of coverage for Teams calls that they’ve come to expect for email and messages. That’s why we’re excited to announce inline protection and SOC- investigation capabilities for Microsoft Teams calls. Microsoft Defender can now stop the interaction while it’s happening and SOC teams can then investigate the full path after the fact.

Hunt and remediate suspicious calls

When attackers use Teams calls to impersonate a brand, internal IT, or a trusted organization, security teams need more than anecdotal user reports—they need forensic visibility and the ability to act. Microsoft Defender has turned Teams calling from a blind spot into a first-class SOC signal, so you can now:

Investigate Teams calling activity at scale through Advanced hunting. Use new call-focused data to identify suspicious patterns and validate risk across the organization. This includes unusual external callers, first-time contacts, or activity that aligns with brand impersonation patterns.

Pivot directly into a call’s details using a call entity experience. Analysts can quickly understand what happened and who was involved, without stitching together context across multiple tools.
Take mitigation actions inline by blocking malicious domains or addresses in Teams via the Tenant Allow/Block List. This turns investigation into immediate containment and helps prevent repeat attempts.
Close the loop with end-user reporting. Pair what users flag as a security risk with what analysts can hunt and confirm. The SOC can move faster and reduce ambiguity when seconds matter.

Figure 1: Teams call activity events in advanced huntingFigure 2: Call entity panel for deeper investigation in advanced hunting

Stop impersonation in real time

While insights are critical, the most effective way to reduce vishing impact is to interrupt social engineering while the user is still deciding what to do.

Now, when a Teams call appears to be impersonating a known organization or trusted entity, users will see a persistent in-call warning banner. It shows during the incoming-call experience and while on the call. That gives users clear, contextual guidance before they comply with attacker instructions. It also extends the same protection approach used for chat impersonation into the calling surface.

Figure 3: Teams call real-time notification informing the user that the call is suspicious.

And because improving protection depends on learning from real interactions, users can also provide feedback by reporting a call as not a security risk to help improve the accuracy of warnings over time.

That makes Defender the only collaboration security tool that provides inline user feedback – in real-time.

Turn Defender telemetry into executive-ready security understanding with the Protection & Posture Insights report

To help organizations clearly understand the threats targeting their environment and how Defender is helping protect against them, we are introducing the Protection & Posture Insights report. It is available directly in the Defender portal and built on tenant-specific telemetry. The report provides a customized view of the spam, phishing, and malware campaigns observed against users—showing how attackers are attempting to gain access, what techniques are being used, who is being targeted, and where risk is concentrated across the environment.

The Protection & Posture Insights report goes beyond surface-level threat counts to highlight patterns and exposure unique to each tenant, including emerging phishing techniques, malware delivery methods, and zero-day threats identified through detonation analysis. It also shows how these threats are handled across delivery locations—such as inbox, junk, and quarantine—and which detection technologies and policies are engaged, giving teams a clearer understanding of how attackers are interacting with their environment.

In addition to threat visibility, the report delivers personalized insights and targeted security policy recommendations based on each customer’s configuration and observed threat activity. By surfacing coverage gaps, priority account targeting, and opportunities to strengthen policy enforcement, teams can take focused action to reduce exposure and improve security posture. With consistent, tenant-specific reporting over time, organizations can validate results, track progress, and share credible, executive-ready security outcomes—without manual data assembly.

Figure 4: Executive summary of the new Protection & Posture Insights report

This kind of personalized visibility answers the most important question for any security team: what was stopped in my environment, and why. It’s also helpful to pair those tenant-specific insights with an objective, industry-wide view. That’s why we publish official email security performance benchmarking. We use consistent, real-world measurements of detection and efficacy across phishing, malware, and spam. That way, you can compare Microsoft Defender against other secure email gateway (SEG) and integrated cloud email security (ICES) solutions. For a deeper look at what the latest results reveal, check out From transparency to action: What the latest Microsoft email security benchmark reveals.

These new Microsoft Defender capabilities close a critical gap in collaboration security. They help customers interrupt Teams call–based social engineering. They also give the SOC actionable call visibility and faster containment to prevent repeat attempts. Combined with the Protection & Posture Insights report, security teams can more easily report what was stopped in their tenant. They can also prioritize the next control improvements and strengthen end‑to‑end SOC outcomes across email and Teams.

Visit Us at RSA 2026

Join us at the Microsoft booth at the Moscone Center to see these innovations in action!

More information:

Learn more about Defender for Office 365
Find out how to protect your organization against multi-modal attacks
Check out our recent blog: Disrupting threats targeting Microsoft Teams

Defender for iOS: “This account has reached its devices limit” even though no devices are listed

Herzlich — Tue, 03 Mar 2026 23:35:06 GMT

I am using all 5 devices available (2 PC's, 1 Mac, 2 IOS devices)
I was trying to install Microsoft Defender for IOS on a new iPhone created by copying from the old phone (iPhone 11) to the new phone (iPhone 17).
I erased my old iPhone 11 while Defender was still installed
My Microsoft account shows zero mobile devices (none were linked to my MS account)
Defender on the new iPhone never completed sign‑in with my MS account
“Sign out everywhere” and app removal didn’t help (also app removal, restart IOS device, reinstall Defender for IOS)
You suspect a stuck Defender mobile enrollment token
You need Microsoft to reset the backend mobile device slot

From Office Copilot:

What to tell the agent (so you don’t get bounced)

Use this exact wording:

“Microsoft Defender for iOS says ‘This account has reached its devices limit’ even though no devices appear in my Microsoft account. My old iPhone was erased while Defender was still signed in. I need my Defender mobile device enrollment reset.”

This sends them straight to the backend reset tool.

Why this works when everything else doesn’t

The issue isn’t on your devices or in your account UI — it’s a server-side Defender mobile quota flag that only Microsoft support can clear. The consumer Defender team (under Microsoft 365 support) is the only group with access to that system.

Part 3: Build custom email security reports with Power BI and workbooks in Microsoft Sentinel

dmozes — Tue, 10 Feb 2026 22:50:16 GMT

TL;DR: We're releasing a brand-new Power BI template for email security reporting and a major update (v3) to the Microsoft Sentinel workbook. Both solutions share the same rich visuals and insights. Choose Power BI for quick deployment without Sentinel, or the Sentinel workbook for extended data retention and multi-tenant scenarios. Get started in minutes with either option.

Introduction

Security teams in both small and large organizations track key metrics to make critical security decisions and identify meaningful trends in their organizations. While Microsoft Defender for Office 365 provides rich, built-in reporting capabilities, many security teams need custom reporting solutions to create dedicated views, combine multiple data sources, and derive deeper insights tailored to their unique requirements.

Earlier last year (Part 1 and Part 2) we shared examples of how you can use workbooks in Microsoft Sentinel to build a custom email security insights dashboard for Microsoft Defender for Office 365.

Today, we are excited to announce the release of a new Power BI template file for Microsoft Defender for Office 365 customers, along with an updated version of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel. Both solutions share the same visual design and structure, giving you a consistent experience regardless of which platform you choose.

Power BI template file - Microsoft Defender for Office 365 Detections and Insights:

Microsoft Sentinel workbook - Microsoft Defender for Office 365 Detections and Insights:

NEW: Power BI template file for Microsoft Defender for Office 365 Detections and Insights

This custom reporting template file utilizes Power BI and Microsoft Defender XDR Advanced Hunting through the Microsoft Graph security API.

It is designed for Microsoft Defender for Office 365 customers who have access to Advanced Hunting but are not using Microsoft Sentinel.

Advanced Hunting data in Microsoft Defender for Office 365 tables is available for up to 30 days. The reporting template uses these same data tables to visualize insights into an organization's email security, including protection, detection, and response metrics provided by Microsoft Defender for Office 365.

Note: If data retention beyond 30 days is required, customers can use the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel.

You can find the new .pbit template file and detailed instructions on how to set up and use it in the unified Microsoft Sentinel and Microsoft 365 Defender GitHub repository.

This new Power BI template uses the same visuals and structure as the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel, providing an easy way to gain deep email security insights across a wide range of use cases.

UPDATED: Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel

We are excited to announce the release of a new version (3.0.0) of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel.

The workbook is part of the Microsoft Defender XDR solution in Microsoft Sentinel and can be installed and started to use with a few simple clicks.

In this new release we incorporated feedback we have received from many customers in the past few months to add new visuals, updated existing visuals and add insights focusing on security operations.

What’s New

Here are some notable changes and new capabilities available in the updated workbook template.

Improved structure: Headings and grouped insights have been added to tabs for easier navigation and understanding of metrics.
Contextual explanations: Each tab, section, and visual now includes descriptions to help users interpret insights effectively.
Drill-down capability: A single “Open query link” action allows users to view the underlying KQL query for each visual, enabling quick investigation and hunting by modifying conditions or removing summaries to access raw data.
Detection Dashboard tab enhancements: Added an example Effectiveness metric, updated visuals to focus on overall Microsoft Defender for Office 365 protection values, and introduced new sections for Emerging Threats and Microsoft 365 Secure Email Gateway Performance.
New Security Operations Center (SOC) Insights tab: Provides operational metrics such as Security Incident Response, Investigation, and Response Actions for SOC teams.
Advanced threat insights: Includes new LLM-based content analysis detections and threat classification insights on the Emails – Phish Detections tab.
External forwarding insights: Added deep visibility into Inbox rules and SMTP forwarding in Outlook, including destination details to assess potential data leakage risks.
Geo-location improvements: Sender IPv4 insights now include top countries for better geographic context for each Threat types (Malware, Spam, Phish).
Enhanced top attacked users and top senders: Added TotalEmailCount and Bad_Traffic_Percentage for richer context in top attacked users and senders charts.
Expanded URL click insights: URL click-based threat detection visuals now include Microsoft 365 Copilot as a workload.

How to use the workbook across multiple tenants

If you manage multiple environments with Microsoft Sentinel — or you are an MSSP (Managed Security Service Provider) working across multiple customer tenants — you can also use the workbook in multi‑tenant scenarios.

Once the required configuration is in place, you can change the Subscription and Workspace parameters in the workbook to be multi select and load data from one or multiple tenants.

This enables to see deep email security insights in multi‑tenant environments, including:

Aggregated multi‑tenant view:
You can view aggregated insights across tenants in a single workbook view. By multi‑selecting tenants in the Subscription and Workspace parameters, the workbook automatically loads and combines data from all selected environments for all visuals on all tabs.

Side‑by-side‑ comparison:
For example, you can compare phishing detection trends or top attacked users across two or more tenants simply by opening the workbook in two browser windows placed side by side.

Note: For the multiselect option‑ to work in the current workbook version, you need to manually adjust the Subscription and Workspace parameters. This configuration is planned to become the default in the next release of the workbook. Until then, you can simply apply this change using the workbook’s Edit mode.

How to get the updated workbook version

The latest version of the Microsoft Defender for Office 365 Detections and Insights workbook is available as part of the Microsoft Defender XDR solution in the Microsoft Sentinel - Content hub. Version 3.0.13 of the solution has the updated workbook template.

If you already have the Microsoft Defender XDR solution deployed, version 3.0.13 is available now as an update. After you install the update, you will have the new workbook template available to use.
Note: If you had the workbook saved from a previous template version, make sure you delete the old workbook and use the save button on the new template to recreate a new local version with the latest updates.

If you install the Microsoft Defender XDR solution for the first time, you are deploying the latest version and will have the updated template ready to use.

How to edit and share the workbook with others

You can customize each visual easily. Simply edit the workbook after saving, then adjust the underlying KQL query, change the type of the visual, or create new insights.

More information: Visualize your data using workbooks in Microsoft Sentinel | Microsoft Learn

Granting other users access to the workbook also possible, see the Manage Access to Microsoft Sentinel Workbooks with Lower Scoped RBAC on the Microsoft Sentinel Blog.

Do you have feedback related to reporting in Microsoft Defender for Office 365?

You can provide direct feedback via filling the form: aka.ms/mdoreportingfeedback

Do you have questions or feedback about Microsoft Defender for Office 365?

Engage with the community and Microsoft experts in the Defender for Office 365 forum. 

More information

Integrate Microsoft Defender XDR with Microsoft Sentinel
Learn more about Microsoft Sentinel workbooks
Learn more about Microsoft Defender XDR

Secure collaboration in Microsoft Teams with efficient and automated Threat Protection and response

MalvikaBalaraj — Wed, 14 Jan 2026 17:00:00 GMT

New Layers of Protection for Teams Messages

With more than 300 million monthly active users on Microsoft Teams, ensuring secure collaboration has become increasingly critical. As the threat landscape continues to change, our security measures must adapt accordingly. To address these challenges, we are pleased to announce enhanced protection and Security Operations response capabilities for enterprise messages containing URLs in Teams, utilizing Microsoft Defender.

Threat Profile – Tech Support Impersonation with Phishing URLs

In previous blogs, we’ve discussed how threat actors are employing multimodal attacks and targeting users in an organization over Teams by impersonating tech support. Lately some of these attackers have been observed steering their victims towards malicious websites that appear purpose-built to complete their harmful objectives while allaying the victim’s suspicions.

The typical attack chain proceeds as follows:

Hybrid attacks often begin with mail bombing (spam) directed at the targeted individual, followed by Teams messages or calls in which the attacker impersonates IT support personnel offering to resolve the spam issue.
Victims may then be deceived into granting system access to the attacker via remote management and monitoring tools such as Quick Assist or AnyDesk.
In recent incidents, attackers have directed victims to malicious URLs that closely resemble legitimate internal IT security update or patching tools, featuring falsified logos and branding.
These sites are actually conventional phishing platforms intended to capture user credentials and enable malware deployment, while victims believe their spam problem is being resolved.

Below: Rendering of a malicious URL shared over Teams by an attacker to an intended victim

Microsoft Defender uses robust detection engines and threat intelligence to support URL warnings, post-delivery protection, and advanced hunting for Teams, enabling comprehensive protection against evolving attack vectors.

Near real-time defense

For Worldwide customers with Teams enterprise licenses and above

Our new advanced near-real-time protection ensures that any message containing URLs is thoroughly scanned and appropriately flagged before delivery. End users are notified with a warning tip upon messages delivery when malicious URLs are detected, helping them recognize and avoid potential risk. Threats don’t always appear right away, to stay ahead of evolving attacks, protection continues for up to 48 hours after a message is delivered. If a previously safe URL later becomes weaponized, the message is automatically updated with a warning tip, ensuring users remain protected even after the message reaches them.

This dual-layered approach means:

Immediate warnings for messages with known malicious URLs.
Post-delivery detection that adapts to evolving threats.
Protection across internal and external communications, including chats and channels, regardless of tenant origin.

These capabilities powered by Microsoft Defender will provide out-of-the-box protection as it will be enabled by default and will be available for all Teams enterprise users, with no additional configuration required. This ensures that every user benefits from advanced protection.

Figure 1: Recipient view of message warningsFigure 2: Sender view of message warnings

Empowering Users and SOC Teams

For worldwide customers with an MDO (Microsoft Defender for Office 365) P2 license or an E5 license

Security is a shared responsibility. We’re enabling users to report false negatives (FN) and false positives (FP) directly from Teams messages. These reports feed into Microsoft Defender investigation workflows, helping improve detection accuracy and reduce support overhead.

Users can now report potentially malicious messages or messages incorrectly detected as malicious directly from the message context menu in Microsoft Teams:

Report as security risk: For messages that seem suspicious but weren’t flagged.
Report as not security risk: For messages that were flagged but are actually safe.

This enables users to actively contribute to their organization's security management and protection efforts, while simultaneously enhancing the accuracy of Microsoft Defender detection controls. Reports may be submitted for both internal and external communications including chats, meetings, and channels ensuring comprehensive coverage across all collaboration platforms such as Teams web, desktop, and mobile clients. Upon submission, these reports are accessible to administrators and security operations personnel in the Microsoft Defender portal as incidents, where they can efficiently triage, investigate, and respond.

Figure 3: Report a concernFigure 4: Report a wrong detection

Holistic Visibility for Security Operation Teams

For worldwide customers with an MDO (Microsoft Defender for Office 365) P2 license or an E5 license

Security Operation teams need context, coverage, and control. That’s why we’ve introduced three new Advanced Hunting tables in Microsoft Defender designed specifically to surface Microsoft Teams message metadata and enable deep investigations across both internal and external communications.

MessageEvents: Captures metadata for all Teams messages containing URLs at the time of delivery.
MessagePostDeliveryEvents: Surfaces messages that were flagged as malicious after delivery, including Zero-hour auto purge (ZAP) actions.
MessageURLInfo: Provides granular details on URLs extracted from Teams messages.

These tables are now generally available in the Microsoft Defeder portal providing direct insight into Teams message flows.

SOC teams can now hunt across all external (federated) messages, not just messages that contain URLs. This is a major step forward in enabling cross-tenant threat detection and response, especially in today’s hybrid collaboration environments. All three tables are accessible via Advanced Hunting APIs and Streaming APIs, allowing SOC teams to integrate hunting workflows into their existing automation pipelines.

To further enhance visibility, we’ve added a new column called SafetyTip to both the MessageEvents and MessagePostDeliveryEvents tables. This column flags whether a URL warning tip was shown to the user in the Teams client, helping SOC teams distinguish between warning and block detections.

Figure 5: Hunt on message warnings

Third-party security information and event management (SIEM) solutions can also integrate with and utilize these hunting tables via the Microsoft Defender Streaming API. For instance, in Splunk, the new tables may be configured to automatically flow into your Splunk instance, supporting extended data retention by leveraging the latest version of the Microsoft Defender Splunk connector. It is important to ensure that the new Teams protection tables are selected during connector configuration to enable the continuous transfer of relevant data.

Figure 6: Connector config and version needed to connect to 3rd party SIEMs

Empower Security Teams to Act Against Threats

For worldwide customers with an MDO (Microsoft Defender for Office 365) P2 license or an E5 license

We’ve introduced a powerful new capability that gives security teams greater control and confidence when managing potential risks in Teams. With this feature, security admins can investigate suspicious conversations in Advanced Hunting and instantly remove internal users from unsafe chats, revoking their access and clearing all prior chat history to prevent further exposure. This proactive step ensures employees stay protected from threat actors and sensitive information remains secure.

The experience is streamlined through the Action Wizard, accessible directly from the Teams entity flyout, making remediation fast and intuitive. Every action is fully traceable in Action Center, providing a centralized view for monitoring and validating security interventions, while audit logs deliver records for reporting. These capabilities empower organizations to contain risks in real time, strengthen collaboration security, and maintain trust across their digital workplace.

Figure 7: remove a user from a conversation directly from the defender portal

Response capabilities for Security Teams

For worldwide customers with an MDO (Microsoft Defender for Office 365) P2 license or an E5 license

In addition to these enhanced detection, investigation and hunting capabilities, security team members are now able to perform advanced response actions for Microsoft Teams directly in the Microsoft Defender portal. Security Operations Center (SOC) analysts and admins can directly block malicious domains from within the Microsoft Defender portal, seamlessly adding targeted entries to the Teams Admin Center (TAC) blocked domains list without leaving their security workflows and switching portals. This capability enables near real-time protection when suspicious or abusive external organizations are identified. SOC teams can immediately block suspicious organizations, effectively halting new external chat messages, invites, and channel communications from those domains while deleting existing ones. These controls empower organizations to react to emerging risks in minutes, all while maintaining compliance and reducing operational overhead.

Figure 8: Block domains in Teams via TABL

Expanding Admin Quarantine and Zero-Hour Auto-Purge (ZAP) to MDO P1

We are also extending the power of Zero-hour auto-purge (ZAP) and Teams admin quarantine to even more customers, bringing this post-delivery protection layer to Microsoft Defender for Office 365 Plan 1. This reinforces our commitment to secure-by-default protection across all Microsoft Teams environments.

ZAP automatically moves malicious messages containing phishing or malware URLs from internal Teams chats and channels to admin quarantine in the Microsoft Defender portal. This post-delivery protection ensures that even if a threat evades initial detection, it can be neutralized before causing harm.

This capability will be enabled by default for all Microsoft Teams customers with Microsoft Defender for Office Plan 1, providing immediate protection without requiring additional configuration. Security admins maintain full control through the Microsoft Defender portal, where quarantined Teams messages can be reviewed, managed, and released if needed. This expansion ensures more customers benefit from continuous, automated threat removal, strengthening protection across Teams with no extra effort required

These new protections reflect our commitment to delivering security that scales effortlessly with the way people work today. By combining real-time detection, post-delivery protection, and user-driven feedback loops, we’re giving organizations the tools to stay ahead of emerging threats without slowing down collaboration.

These capabilities are engineered to operate efficiently in the background, providing assurance and proactive security measures. This enables frontline workers, IT administrators, and SOC analysts to concentrate on their core responsibilities while maintaining a secure working environment.

To learn more

I have absolutely no idea what Microsoft Defender 365 wants me to do here

JustTom — Tue, 30 Dec 2025 15:30:01 GMT

The process starts with an emal:

There's more below on the email - an offer for credit monitoring, an option to add another device, an option to download the mobile app - but I don't want to do any of the, so I click on the "Open Defender" button, which results in this:

OK, so my laptop is the bad boy here, there's that Status not of "Action recommended", with no "recommendations" and the only live link here is "Add device", something I don't need to do. The only potential "problem" I can even guess at here is that Microsoft is telling me that the laptop needs updating. Since I seldom use the laptop, only when traveling, I'd guess the next time I'd fire it up the update will occur, but of course I really don't know that's the recommended action it's warning me about, do I?

You'd expect that if something is warning you "ACTION NEEDED!!!" they'd be a little more explicit, wouldn't you?

Tenant Forwarding - Trusted ARC Sealer

weebles — Tue, 16 Dec 2025 16:57:00 GMT

As part of a tenant to tenant migration we often need to forward mail from one tenant to another. This can cause some issues with email authentication verdicts on the destination tenant. Is it possible or best practice to configure another tenant as a Trusted ARC sealer to help with forwarded email deliverability?

Strengthening calendar security through enhanced remediation

nithinnara — Mon, 24 Nov 2025 17:00:00 GMT

In today’s evolving threat landscape, phishing attacks are becoming increasingly sophisticated, often leveraging meeting invites to bypass traditional defenses. While Security Operations (SOC) teams rely on Microsoft Defender’s remediation actions to remove malicious emails, a hidden risk persists: calendar entries created by Outlook during email delivery. These entries can remain active even after the email is deleted, leaving users exposed to harmful content. This update addresses that gap.

Remediation supports cleaning up calendar entries

SOC teams currently use remediation actions such as Move to Junk, Delete, Soft Delete, and Hard Delete to quickly eliminate email threats from user inboxes. However, meeting invite emails introduce an additional challenge. Even after the email is removed, Outlook automatically creates a calendar entry during delivery, which remains accessible to users.

For example, consider a phishing email sent as a meeting invite. Despite the admin removing the email from the user’s inbox, the user can still interact with the same malicious content via the calendar entry.

This residual entry may contain harmful links or phishing content, creating a security gap. With this update, we’re taking the first step toward closing that gap. Hard Delete will now also remove the associated calendar entry for any meeting invite email. This ensures threats are fully eradicated—not just from the inbox but also from the calendar—reducing the risk of user interaction with malicious content.

This change applies to Hard Delete actions taken from any surface, including Explorer, Advanced Hunting, and API.

Note:

1) Deleted calendar entries can be restored by resending the meeting invite.

2) This action does not remove calendar entries manually added by users via .ics files.

Ability to Block URL domains via submission/TABL actions from Explorer

SOC teams can currently add senders and URLs to the TABL block list when submitting false negatives to Microsoft. However, phishing campaigns often use variations of URLs under the same parent domain, making full URL blocking less effective.

With this update, TABL options for URL domains are now dynamically surfaced, enabling SOC teams to block entire domains without leaving their workflow. This enhancement simplifies remediation and strengthens defenses against domain-based phishing attacks.

These updates strengthen SOC remediation workflows by closing critical security gaps and ensuring threats are fully neutralized across all user touchpoints. By extending remediation to calendar entries and enabling domain-level URL blocking, we deliver comprehensive protection that reduces risk, streamlines operations, and safeguards user experiences. At Microsoft, our priority is your security, and we remain committed to empowering SOC teams with tools that make defense smarter and more effective.

Learn more:

Remediate malicious email that was delivered in Office 365 - Microsoft Defender for Office 365 | Microsoft Learn

Email - Override/Bypass Events

mhmmdrn — Mon, 24 Nov 2025 10:39:23 GMT

Hi Community,

how can i extract the override/bypass informations by using EXO Powershell Module, Advanced Hunting or Graph API? I have searched in cmdlets but no luck.