rss.livelink.threads-in-node

Granular email content access with unified RBAC – now the default for new Defender tenants

VipulPandey — Wed, 29 Apr 2026 16:00:00 GMT

Email investigations are a key part of detecting and responding to phishing and malware. As security workflows continue to evolve, there is an increasing need to align email content visibility more closely with specific roles and scenarios, such as Tier‑1 analysis or specialized workflows like user‑reported phishing triage.

Today we’re announcing additional “read-only” controls for more granular email access in Microsoft Defender and that starting on May 30^th, 2026, unified RBAC will become the new default for permission modeling for new tenants.

Unified RBAC in Microsoft Defender: a single, consistent permissions model

Microsoft Defender unified role‑based access control (RBAC) provides a centralized way to manage permissions across the Defender security portfolio, replacing the need to configure and audit access separately for each solution, including endpoint, identity, SaaS, Cloud, and more. Instead of stitching together service‑specific role models, unified RBAC gives security teams one consistent authorization framework to control what users can see and do across the Microsoft Defender portal.

Unified RBAC is designed to support modern security operations by aligning access with real‑world roles, such as analysts, investigators, and administrators, while reducing the risk that comes from over‑permissioned accounts including:

Enforcing least‑privilege access consistently
Understanding who has access to sensitive data across services
Performing clean access reviews and audits
Scaling permissions safely in tiered SOC or partner‑managed environments

Unified RBAC addresses these challenges by converging permissions into a single model and separates read-only (data access) and manage (action‑taking) permissions by design, making access intent explicit and reducing accidental overexposure of sensitive security data.

More granular email permissions within unified RBAC

Unified RBAC now supports additional read‑only permissions for specific email content scenarios—so access can be matched precisely to investigation and review workflows.

1. New permission-Email & collaboration content: Emails associated with alerts

The new Emails associated with alerts permission allows analysts to preview or download emails only when they are directly associated with a security alert, without granting access to all email content. Initially, this permission applies to alerts of type Email reported by user as malware or phish and Email reported by user as junk, which is one of the most common investigation entry points for security teams. Only emails tied to that alert type can be previewed or downloaded. Support for additional alert types will expand in future updates.

Why this matters: Tier‑1 analysts and triage teams can investigate user‑reported threats quickly and effectively, without being granted visibility into unrelated emails.

2. New permission- Email and Collaboration content: Quarantine Emails

This new permission allows previewing and downloading only emails that are in admin quarantine, supporting roles responsible for reviewing or validating quarantined messages – without broader email access.

Important: After this update, Email & collaboration quarantine and Security data basics will no longer provide email content preview or download by themselves. To allow content visibility for quarantined messages, you must explicitly assign Emails in Quarantine. This change clarifies role boundaries and simplifies audits by making content access intentional and explicit. Read more here.

Why this matters: Quarantine review teams can access exactly what they need—no more, no less—supporting least-privilege access by design.

These permissions extend the Unified RBAC model for email & collaboration by separating visibility from action. They allow security teams to grant targeted access to email content only where it’s required, while preserving full content access for senior investigators and incident response teams.

Full email content access remains available through existing permissions—such as Email & collaboration content: All emails—for senior investigators and incident response teams who require unrestricted visibility.

Unified RBAC becomes the default for new Microsoft Defender tenants

Starting May 30^th, 2026, Unified RBAC will be enabled by default for new Microsoft Defender for Office 365 Plan 2 tenants, making it the primary permissions model that enables a single, unified authorization model across the Defender suite. Permissions are managed through Defender unified RBAC roles, alongside Microsoft Entra roles where applicable (e.g. for Attack Simulation Training). Making Unified RBAC the default for new tenants is a key step toward simplifying permissions management and embeds least-privilege access by design.

Learn more

Declutter and Defend: Reducing promotional mail noise with Microsoft Defender

FaithEbenezerOquong — Thu, 23 Apr 2026 03:59:21 GMT

Enterprise inboxes are overwhelmed with graymail — legitimate, bulk email like newsletters, vendor promotions, and product updates that isn't malicious but buries the messages that matter. When high volumes of these mails land in the inbox, it crowds out priority communications and can dull security vigilance. Employees conditioned to ignore repetitive emails may miss signs of a real threat. It also creates recurring work for admins and security teams who must continuously tune filters, manage exception requests, and chase noise from user reports for email that isn’t malicious. Because graymail passes every spam filter check, traditional defenses don't separate it — leaving this signal-to-noise gap unaddressed.

Today we’re excited to announce that Microsoft Defender now includes built-in graymail filtering. It is delivered natively through a new Promotions experience in Outlook that automatically classifies and separates bulk email, so it no longer competes with business-critical communication in the inbox. Now in Public Preview, this capability learns from how users interact with graymail to become more accurate over time. Coupled with the existing Bulk Senders Insight report, Defender brings data-driven bulk classification and control into the security workflows you already use.

What Is Graymail?

Graymail is legitimate bulk email that isn't malicious—product newsletters, event announcements, marketing promotions, and software update notifications from reputable, authenticated senders. It is distinct from spam and from phishing - graymail comes from real organizations with proper authentication and traditional spam filters aren't designed to handle it.

Graymail handling in Microsoft Defender

Microsoft Defender's approach is built on three principles: classify intelligently, deliver natively, and learn continuously.

Promotions Folder — Intelligent Inbox Organization

A dedicated Promotions folder, natively provisioned in Outlook, now keeps legitimate bulk mail out of the primary inbox. Promotional content is separated from priority emails without being sent to Junk, which means users can still access and browse newsletters and updates at their own pace. The folder appears at the top level of the mailbox for easy discovery and is visible across all Outlook experiences.

Non-spam bulk mail below the organization's configured Bulk Complaint Level threshold is automatically routed to the Promotions folder.
Messages from senders the user has explicitly allowed continue to land in the Inbox.
Messages identified as spam continue to go to Junk.

To enable the Promotions folder administrators need to enable the "Bulk Moves Enabled" setting in their anti-spam policy. The Promotions folder is then created for all users and used for routing only when this setting is ON.

Existing mail flow is unaffected.

Figure 1: system tagging of “Promotions” in outlook client and promotions folder (previously tagged as “Bulk” in private and public preview)

Promotional mail tagging and Mailbox Rule Support

Messages classified as graymail will automatically be labeled with a "Promotions" system tag in Outlook. The tag provides instant visual context without requiring users to open each message and is visible in Outlook on the Web and the native Outlook desktop apps for Windows and Mac. During Public Preview, the tagging component is opt-in, requiring administrators to enable it by configuring an Exchange Transport Rule. Once generally available, it will be enabled by default.

Because this classification is integrated at the client level, the Promotions tag can also be used as a condition in Outlook mailbox rules. This enables custom routing logic for advanced scenarios like moving all promotions-tagged messages from a specific sender to a custom folder, flagging certain promotional emails for follow-up, or auto-forwarding or deleting promotions that meet specific criteria. This transforms the Promotions classification from a one-way filter into a flexible building block for personal and organizational workflows—particularly valuable for power users and teams with compliance or archival requirements.

Figure 2: User inbox rules using “Promotion” tag (previously “Bulk” in private and public preview)

Adaptive Learning

Microsoft Defender's graymail filtering gets smarter with every interaction. The system learns directly from how users handle their mail. When a user moves a message out of the Promotions folder and back to the Inbox, future emails from that sender will no longer be placed in the Promotions folder. When a user moves a message from the Inbox into the Promotions folder, future emails from that sender will be routed to the Promotions folder automatically.

This creates a personalized, self-improving experience that becomes more accurate over time - no manual rule configuration required, no safe-sender lists to maintain, and no filtering rules for IT teams to manage on behalf of individual employees.

Built into existing Security Workflows

Administrators also gain visibility through the Bulk Senders Insight report, which provides data-driven guidance on what your organization actually receives and can help tune your bulk mail filtering.

Graymail has long been the unsolved middle ground of email security—too legitimate to block, too noisy to ignore. Microsoft Defender now handles it where it should be handled: inside the platform, inside the mailbox, and inside the security workflows your organization already relies on. No new portals, no new vendors, no compromise between security and user experience.

Get Started

Configure promotions tagging and the promotions folder today - Bulk email detection documentation on Microsoft Learn.
Monitor the experience using the Bulk Senders Insight report.

Enable per‑user language selection for phishing simulation emails and landing pages

POlsen — Tue, 21 Apr 2026 17:17:40 GMT

We use Attack Simulation Training to deliver phishing simulations to a global, multilingual user base. While Microsoft Defender supports multi‑language content, phishing simulation emails and landing pages are currently delivered in a single selected language per campaign.

We are requesting a feature that allows phishing simulation emails and associated landing pages (including credential‑harvest pages) to automatically render in each user’s preferred language, based on:

Outlook mailbox language settings, and/or
Microsoft Entra ID user language preferences

This capability would:

Improve realism and accuracy of phishing simulations
Ensure users experience simulations in the same language they normally work in
Improve behavioral measurement in global organizations
Reduce the need to create and manage multiple parallel simulations by language

Providing consistent, per‑user language alignment across simulation emails, landing pages, and follow‑up training would significantly enhance the effectiveness of Attack Simulation Training for large, multilingual enterprises.

Enable automatic per‑user language selection for Defender training modules

POlsen — Tue, 21 Apr 2026 17:15:09 GMT

We use Attack Simulation Training and Microsoft Defender training modules as part of our security awareness program for a global audience.

Currently, training content is assigned in a single language per campaign, even though users already have preferred language settings defined in Outlook and Microsoft Entra ID (Azure AD). This creates challenges for multinational organizations and often requires duplicating campaigns or accepting that some users receive training in a non‑preferred language.

We are requesting a capability that allows Defender training modules to automatically display in each user’s preferred language, based on:

Outlook mailbox language settings, and/or
Microsoft Entra ID user language preferences

Enabling per‑user language selection would:

Improve comprehension and learning outcomes
Increase training effectiveness for non‑native speakers
Reduce administrative overhead and duplicated campaigns
Align Defender training with existing Microsoft 365 localization behavior

Defender already supports training content in multiple languages. Allowing dynamic language delivery per user would significantly improve scalability and usability for enterprise security awareness programs.

Announcing Public Preview: Security Copilot’s Email Summary in Microsoft Defender

cristinadagamah — Tue, 14 Apr 2026 20:19:58 GMT

Co-Authors: Cristina Da Gama Henriquez and Ajaj Shaikh

AI is rapidly reshaping both sides of the security landscape, and email remains one of the most common and complex entry points for attacks. As adversaries use AI to scale more sophisticated phishing and email-based threats, defenders are under pressure not just to detect them, but to quickly understand what actually happened. Microsoft continues to apply generative and agentic AI across the email protection stack to help stop threats before they reach the inbox and catch what inevitably gets through in the SOC. Still, for security analysts, understanding an email threat requires piecing together context across the incident and its related artifacts. Much of that context exists within the Email entity experience, but it is spread across metadata, timelines, URLs, and attachments, making it time-consuming to connect the dots and act with confidence.

Today, we are excited to announce the public preview of Security Copilot’s Email summary capability, designed to bring those insights together and make email threat investigations faster, clearer, and more actionable. With Security Copilot included in Microsoft 365 E5, organizations will be able to bring AI directly into their flow of work—extending these benefits across the SOC at no additional cost.*

Bringing clarity into the investigation workflow

Email summary brings AI-generated context directly into the Email entity page, transforming fragmented detection data into a clear, natural-language explanation of what happened and why. Analysts can access it from the Security Copilot right-side pane, the same place where Copilot activity across Microsoft Defender is surfaced. Instead of navigating across multiple views to reconstruct the story, analysts can generate a summary that connects the signals and highlights what matters most. And it all happens in seconds.

Built on Security Copilot’s summarization capabilities, Email summary uses the same data analysts already rely on, like email metadata, timeline events, URLs, and attachments, and turns it into a cohesive narrative. It explains how a message was evaluated, what actions were taken, and where risk exists, without requiring manual correlation.

A summary that follows how analysts think

The experience is intentionally embedded in the Email entity page, where investigations already happen, so analysts don’t have to change how they work to benefit from it. The output is structured to match how analysts approach an investigation. It starts with a concise overview of the email, including what was detected, what actions were taken, and any key indicators. From there, it walks through the timeline of events, helping reconstruct how the email was delivered, interacted with, and remediated. It also breaks down URLs and attachments, calling out malicious signals and explaining associated risks in plain language.

Importantly, this is a user-triggered experience. Analysts generate a summary when they need it, ensuring the capability is both intentional and efficient.

From fragmented data to confident decisions

Email summary is a foundational step toward making email threat investigations more explainable and efficient. Today, it brings together existing signals into a clear, actionable narrative. Over time, it will evolve to incorporate additional signal depth: detonation (sandboxing) results, submission responses, and more granular insights from the filtering stack, further strengthening the completeness and fidelity of each investigation.

As threats continue to grow in speed and sophistication, the ability to quickly understand and act is just as critical as detection itself. Email summary helps close that gap, giving analysts the clarity they need to respond with confidence.

*Eligible Microsoft 365 E5 customers will have 400 Security Compute Units (SCUs) per month for every 1,000 user licenses, up to 10,000 SCUs per month. This included capacity is expected to support typical scenarios. Customers will have an option to pay for scaling beyond the allocated amount at a future date with $6 per SCU on a pay-as-you-go basis, and will get a 30-day advanced notification when this option is available. Learn more.

Do XDR Alerts cover the same alerts available in Alert Policies?

underQualifried — Thu, 02 Apr 2026 18:43:55 GMT

The alerts in question are the 'User requested to release a quarantined message', 'User clicked a malicious link', etc. About 8 of these we send to 'email address removed for privacy reasons'. That administrator account has an EOM license, so Outlook rules can be set. We set rules to forward those 8 alerts to our 'email address removed for privacy reasons' address. This is, very specifically, so the alert passes through the @tenant.com address, and our ticketing endpoint knows what tenant sent it. But this ISN'T ideal because it requires an EOP license (or similar - this actually hasn't been an issue until now just because of our customer environments). I've looked at the following alternatives: -

Setting email address removed for privacy reasons as the recipient directly on the Alert Policies in question. This results in the mail going directly from microsoft to our Ticketing Portal - so it ends up sorted into Microsoft tickets. and the right team doesn't get it.
SMTP Forwarding via either Exchange AC User controls or Mail Flow Rules. But these aren't traditional forwarding, and they have the same issue as above.
Making administrator @tenant.com a SHARED mailbox that we can also login to (for administration purposes). But this doesn't allow you to set Outlook rules (or even login to Outlook).

I've checked out the newer alerts under Defender's Settings panel - XDR alerts, I think they're called. Wondering if these can be leveraged at all for this? Essentially, trying to get these Alerts to come to our external ticketing address, from the tenants domain (instead of Microsoft). I could probably update Autotask's rules to check for a header, and set that header via Mail Flow rules, but.. just hoping I don't have to do that for everyone.

Impersonation Protection: Users to Protect should also be Trusted Senders

underQualifried — Thu, 02 Apr 2026 18:30:38 GMT

Hey all, sort of a weird question here. Teaching my staff about Impersonation Protection, and it's kind of occurred to me that any external sender added to 'Senders to Protect' sort of implicitly should also be a 'Trusted Sender'. Example - we're an MSP, and we want our Help Desk (email address removed for privacy reasons) to be protected from impersonation. Specifically, we want to protect the 'Help Desk' name. So we add email address removed for privacy reasons to Senders to protect. However, we ALSO want to make sure our emails come thru. So we've ALSO had to add email address removed for privacy reasons to Trusted Senders on other tenants.

Chats with Copilot have sort of given me an understanding that this is essentially a 'which is more usefuI' scenario. But CoPilot makes things up, and I want some human input.

In theory, ANYONE we add to 'trusted senders' we ALSO want protected from Impersonation. Anyone we protect from Impersonation we ALSO want to trust. Copilot says you SHOULDN'T do both.

Which is better / more practical?

I would like to know the complete list of alerts whose serviceSource is MDO

Kota2 — Tue, 31 Mar 2026 12:14:37 GMT

Hi all

In order to determine the alerts that should be monitored by the SOC, I would like to identify, from the alerts listed at the link below, those whose serviceSource is Microsoft Defender for Office 365 (MDO).

Alert policies in the Microsoft Defender portal - Microsoft Defender XDR | Microsoft Learn

I couldn’t find where this is documented, no matter how thoroughly I searched, so I would appreciate it if you could point me to the relevant documentation.

thx

From Impersonation Calls to Transparent Reporting: Defending the New Front Door of Attacks

JeffreyPinkston — Fri, 27 Mar 2026 23:13:51 GMT

Email is still a major entry point—but it’s no longer the only one that matters. Today’s attackers are increasingly shifting to collaboration channels like Microsoft Teams, where trust is implicit and interaction is real time. Decisions happen fast, and that changes the economics of attacks. Adversaries can pressure users, adapt on the fly, and accelerate their objectives before traditional controls have time to respond. They can then pivot laterally across identities, endpoints, and cloud apps.

And it’s not just chats and shared links anymore. Teams calling has emerged as a high-impact social-engineering path—a “front door” attackers can use to bypass inbox defenses. They can impersonate familiar brands or internal functions. They can also try to extract credentials or persuade a user to take immediate action. In a typical flow, an attacker leverages urgency and context. For example, they may reference an “account issue” following suspicious email activity. They then use the real-time pressure of a call to drive a user toward compromise. That’s why protection must happen directly in the collaboration experience.

At RSA 2026, we’re announcing new Microsoft Defender capabilities designed for exactly this reality. They give SOC teams visibility that matches how attacks unfold across Microsoft Teams. They also help end users easily identify impersonation attempts, so they can stop them before compromise. And we’re introducing the new Protection and Posture Insights report, which provides tenant-specific insights about your collaboration security with Microsoft Defender.

Protect your organization from voice-based attacks in Microsoft Teams

Voice phishing (vishing) is a fast-growing vector because it lets attackers bypass message-based filters and manipulate targets in real time. But security teams haven’t had the same level of coverage for Teams calls that they’ve come to expect for email and messages. That’s why we’re excited to announce inline protection and SOC- investigation capabilities for Microsoft Teams calls. Microsoft Defender can now stop the interaction while it’s happening and SOC teams can then investigate the full path after the fact.

Hunt and remediate suspicious calls

When attackers use Teams calls to impersonate a brand, internal IT, or a trusted organization, security teams need more than anecdotal user reports—they need forensic visibility and the ability to act. Microsoft Defender has turned Teams calling from a blind spot into a first-class SOC signal, so you can now:

Investigate Teams calling activity at scale through Advanced hunting. Use new call-focused data to identify suspicious patterns and validate risk across the organization. This includes unusual external callers, first-time contacts, or activity that aligns with brand impersonation patterns.

Pivot directly into a call’s details using a call entity experience. Analysts can quickly understand what happened and who was involved, without stitching together context across multiple tools.
Take mitigation actions inline by blocking malicious domains or addresses in Teams via the Tenant Allow/Block List. This turns investigation into immediate containment and helps prevent repeat attempts.
Close the loop with end-user reporting. Pair what users flag as a security risk with what analysts can hunt and confirm. The SOC can move faster and reduce ambiguity when seconds matter.

Figure 1: Teams call activity events in advanced huntingFigure 2: Call entity panel for deeper investigation in advanced hunting

Stop impersonation in real time

While insights are critical, the most effective way to reduce vishing impact is to interrupt social engineering while the user is still deciding what to do.

Now, when a Teams call appears to be impersonating a known organization or trusted entity, users will see a persistent in-call warning banner. It shows during the incoming-call experience and while on the call. That gives users clear, contextual guidance before they comply with attacker instructions. It also extends the same protection approach used for chat impersonation into the calling surface.

Figure 3: Teams call real-time notification informing the user that the call is suspicious.

And because improving protection depends on learning from real interactions, users can also provide feedback by reporting a call as not a security risk to help improve the accuracy of warnings over time.

That makes Defender the only collaboration security tool that provides inline user feedback – in real-time.

Turn Defender telemetry into executive-ready security understanding with the Protection & Posture Insights report

To help organizations clearly understand the threats targeting their environment and how Defender is helping protect against them, we are introducing the Protection & Posture Insights report. It is available directly in the Defender portal and built on tenant-specific telemetry. The report provides a customized view of the spam, phishing, and malware campaigns observed against users—showing how attackers are attempting to gain access, what techniques are being used, who is being targeted, and where risk is concentrated across the environment.

The Protection & Posture Insights report goes beyond surface-level threat counts to highlight patterns and exposure unique to each tenant, including emerging phishing techniques, malware delivery methods, and zero-day threats identified through detonation analysis. It also shows how these threats are handled across delivery locations—such as inbox, junk, and quarantine—and which detection technologies and policies are engaged, giving teams a clearer understanding of how attackers are interacting with their environment.

In addition to threat visibility, the report delivers personalized insights and targeted security policy recommendations based on each customer’s configuration and observed threat activity. By surfacing coverage gaps, priority account targeting, and opportunities to strengthen policy enforcement, teams can take focused action to reduce exposure and improve security posture. With consistent, tenant-specific reporting over time, organizations can validate results, track progress, and share credible, executive-ready security outcomes—without manual data assembly.

Figure 4: Executive summary of the new Protection & Posture Insights report

This kind of personalized visibility answers the most important question for any security team: what was stopped in my environment, and why. It’s also helpful to pair those tenant-specific insights with an objective, industry-wide view. That’s why we publish official email security performance benchmarking. We use consistent, real-world measurements of detection and efficacy across phishing, malware, and spam. That way, you can compare Microsoft Defender against other secure email gateway (SEG) and integrated cloud email security (ICES) solutions. For a deeper look at what the latest results reveal, check out From transparency to action: What the latest Microsoft email security benchmark reveals.

These new Microsoft Defender capabilities close a critical gap in collaboration security. They help customers interrupt Teams call–based social engineering. They also give the SOC actionable call visibility and faster containment to prevent repeat attempts. Combined with the Protection & Posture Insights report, security teams can more easily report what was stopped in their tenant. They can also prioritize the next control improvements and strengthen end‑to‑end SOC outcomes across email and Teams.

Visit Us at RSA 2026

Join us at the Microsoft booth at the Moscone Center to see these innovations in action!

More information:

Learn more about Defender for Office 365
Find out how to protect your organization against multi-modal attacks
Check out our recent blog: Disrupting threats targeting Microsoft Teams

Defender for iOS: “This account has reached its devices limit” even though no devices are listed

Herzlich — Tue, 03 Mar 2026 23:35:06 GMT

I am using all 5 devices available (2 PC's, 1 Mac, 2 IOS devices)
I was trying to install Microsoft Defender for IOS on a new iPhone created by copying from the old phone (iPhone 11) to the new phone (iPhone 17).
I erased my old iPhone 11 while Defender was still installed
My Microsoft account shows zero mobile devices (none were linked to my MS account)
Defender on the new iPhone never completed sign‑in with my MS account
“Sign out everywhere” and app removal didn’t help (also app removal, restart IOS device, reinstall Defender for IOS)
You suspect a stuck Defender mobile enrollment token
You need Microsoft to reset the backend mobile device slot

From Office Copilot:

What to tell the agent (so you don’t get bounced)

Use this exact wording:

“Microsoft Defender for iOS says ‘This account has reached its devices limit’ even though no devices appear in my Microsoft account. My old iPhone was erased while Defender was still signed in. I need my Defender mobile device enrollment reset.”

This sends them straight to the backend reset tool.

Why this works when everything else doesn’t

The issue isn’t on your devices or in your account UI — it’s a server-side Defender mobile quota flag that only Microsoft support can clear. The consumer Defender team (under Microsoft 365 support) is the only group with access to that system.

Part 3: Build custom email security reports with Power BI and workbooks in Microsoft Sentinel

dmozes — Tue, 10 Feb 2026 22:50:16 GMT

TL;DR: We're releasing a brand-new Power BI template for email security reporting and a major update (v3) to the Microsoft Sentinel workbook. Both solutions share the same rich visuals and insights. Choose Power BI for quick deployment without Sentinel, or the Sentinel workbook for extended data retention and multi-tenant scenarios. Get started in minutes with either option.

Introduction

Security teams in both small and large organizations track key metrics to make critical security decisions and identify meaningful trends in their organizations. While Microsoft Defender for Office 365 provides rich, built-in reporting capabilities, many security teams need custom reporting solutions to create dedicated views, combine multiple data sources, and derive deeper insights tailored to their unique requirements.

Earlier last year (Part 1 and Part 2) we shared examples of how you can use workbooks in Microsoft Sentinel to build a custom email security insights dashboard for Microsoft Defender for Office 365.

Today, we are excited to announce the release of a new Power BI template file for Microsoft Defender for Office 365 customers, along with an updated version of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel. Both solutions share the same visual design and structure, giving you a consistent experience regardless of which platform you choose.

Power BI template file - Microsoft Defender for Office 365 Detections and Insights:

Microsoft Sentinel workbook - Microsoft Defender for Office 365 Detections and Insights:

NEW: Power BI template file for Microsoft Defender for Office 365 Detections and Insights

This custom reporting template file utilizes Power BI and Microsoft Defender XDR Advanced Hunting through the Microsoft Graph security API.

It is designed for Microsoft Defender for Office 365 customers who have access to Advanced Hunting but are not using Microsoft Sentinel.

Advanced Hunting data in Microsoft Defender for Office 365 tables is available for up to 30 days. The reporting template uses these same data tables to visualize insights into an organization's email security, including protection, detection, and response metrics provided by Microsoft Defender for Office 365.

Note: If data retention beyond 30 days is required, customers can use the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel.

You can find the new .pbit template file and detailed instructions on how to set up and use it in the unified Microsoft Sentinel and Microsoft 365 Defender GitHub repository.

This new Power BI template uses the same visuals and structure as the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel, providing an easy way to gain deep email security insights across a wide range of use cases.

UPDATED: Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel

We are excited to announce the release of a new version (3.0.0) of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel.

The workbook is part of the Microsoft Defender XDR solution in Microsoft Sentinel and can be installed and started to use with a few simple clicks.

In this new release we incorporated feedback we have received from many customers in the past few months to add new visuals, updated existing visuals and add insights focusing on security operations.

What’s New

Here are some notable changes and new capabilities available in the updated workbook template.

Improved structure: Headings and grouped insights have been added to tabs for easier navigation and understanding of metrics.
Contextual explanations: Each tab, section, and visual now includes descriptions to help users interpret insights effectively.
Drill-down capability: A single “Open query link” action allows users to view the underlying KQL query for each visual, enabling quick investigation and hunting by modifying conditions or removing summaries to access raw data.
Detection Dashboard tab enhancements: Added an example Effectiveness metric, updated visuals to focus on overall Microsoft Defender for Office 365 protection values, and introduced new sections for Emerging Threats and Microsoft 365 Secure Email Gateway Performance.
New Security Operations Center (SOC) Insights tab: Provides operational metrics such as Security Incident Response, Investigation, and Response Actions for SOC teams.
Advanced threat insights: Includes new LLM-based content analysis detections and threat classification insights on the Emails – Phish Detections tab.
External forwarding insights: Added deep visibility into Inbox rules and SMTP forwarding in Outlook, including destination details to assess potential data leakage risks.
Geo-location improvements: Sender IPv4 insights now include top countries for better geographic context for each Threat types (Malware, Spam, Phish).
Enhanced top attacked users and top senders: Added TotalEmailCount and Bad_Traffic_Percentage for richer context in top attacked users and senders charts.
Expanded URL click insights: URL click-based threat detection visuals now include Microsoft 365 Copilot as a workload.

How to use the workbook across multiple tenants

If you manage multiple environments with Microsoft Sentinel — or you are an MSSP (Managed Security Service Provider) working across multiple customer tenants — you can also use the workbook in multi‑tenant scenarios.

Once the required configuration is in place, you can change the Subscription and Workspace parameters in the workbook to be multi select and load data from one or multiple tenants.

This enables to see deep email security insights in multi‑tenant environments, including:

Aggregated multi‑tenant view:
You can view aggregated insights across tenants in a single workbook view. By multi‑selecting tenants in the Subscription and Workspace parameters, the workbook automatically loads and combines data from all selected environments for all visuals on all tabs.

Side‑by-side‑ comparison:
For example, you can compare phishing detection trends or top attacked users across two or more tenants simply by opening the workbook in two browser windows placed side by side.

Note: For the multiselect option‑ to work in the current workbook version, you need to manually adjust the Subscription and Workspace parameters. This configuration is planned to become the default in the next release of the workbook. Until then, you can simply apply this change using the workbook’s Edit mode.

How to get the updated workbook version

The latest version of the Microsoft Defender for Office 365 Detections and Insights workbook is available as part of the Microsoft Defender XDR solution in the Microsoft Sentinel - Content hub. Version 3.0.13 of the solution has the updated workbook template.

If you already have the Microsoft Defender XDR solution deployed, version 3.0.13 is available now as an update. After you install the update, you will have the new workbook template available to use.
Note: If you had the workbook saved from a previous template version, make sure you delete the old workbook and use the save button on the new template to recreate a new local version with the latest updates.

If you install the Microsoft Defender XDR solution for the first time, you are deploying the latest version and will have the updated template ready to use.

How to edit and share the workbook with others

You can customize each visual easily. Simply edit the workbook after saving, then adjust the underlying KQL query, change the type of the visual, or create new insights.

More information: Visualize your data using workbooks in Microsoft Sentinel | Microsoft Learn

Granting other users access to the workbook also possible, see the Manage Access to Microsoft Sentinel Workbooks with Lower Scoped RBAC on the Microsoft Sentinel Blog.

Do you have feedback related to reporting in Microsoft Defender for Office 365?

You can provide direct feedback via filling the form: aka.ms/mdoreportingfeedback

Do you have questions or feedback about Microsoft Defender for Office 365?

Engage with the community and Microsoft experts in the Defender for Office 365 forum. 

More information

Integrate Microsoft Defender XDR with Microsoft Sentinel
Learn more about Microsoft Sentinel workbooks
Learn more about Microsoft Defender XDR

Secure collaboration in Microsoft Teams with efficient and automated Threat Protection and response

MalvikaBalaraj — Wed, 14 Jan 2026 17:00:00 GMT

New Layers of Protection for Teams Messages

With more than 300 million monthly active users on Microsoft Teams, ensuring secure collaboration has become increasingly critical. As the threat landscape continues to change, our security measures must adapt accordingly. To address these challenges, we are pleased to announce enhanced protection and Security Operations response capabilities for enterprise messages containing URLs in Teams, utilizing Microsoft Defender.

Threat Profile – Tech Support Impersonation with Phishing URLs

In previous blogs, we’ve discussed how threat actors are employing multimodal attacks and targeting users in an organization over Teams by impersonating tech support. Lately some of these attackers have been observed steering their victims towards malicious websites that appear purpose-built to complete their harmful objectives while allaying the victim’s suspicions.

The typical attack chain proceeds as follows:

Hybrid attacks often begin with mail bombing (spam) directed at the targeted individual, followed by Teams messages or calls in which the attacker impersonates IT support personnel offering to resolve the spam issue.
Victims may then be deceived into granting system access to the attacker via remote management and monitoring tools such as Quick Assist or AnyDesk.
In recent incidents, attackers have directed victims to malicious URLs that closely resemble legitimate internal IT security update or patching tools, featuring falsified logos and branding.
These sites are actually conventional phishing platforms intended to capture user credentials and enable malware deployment, while victims believe their spam problem is being resolved.

Below: Rendering of a malicious URL shared over Teams by an attacker to an intended victim

Microsoft Defender uses robust detection engines and threat intelligence to support URL warnings, post-delivery protection, and advanced hunting for Teams, enabling comprehensive protection against evolving attack vectors.

Near real-time defense

For Worldwide customers with Teams enterprise licenses and above

Our new advanced near-real-time protection ensures that any message containing URLs is thoroughly scanned and appropriately flagged before delivery. End users are notified with a warning tip upon messages delivery when malicious URLs are detected, helping them recognize and avoid potential risk. Threats don’t always appear right away, to stay ahead of evolving attacks, protection continues for up to 48 hours after a message is delivered. If a previously safe URL later becomes weaponized, the message is automatically updated with a warning tip, ensuring users remain protected even after the message reaches them.

This dual-layered approach means:

Immediate warnings for messages with known malicious URLs.
Post-delivery detection that adapts to evolving threats.
Protection across internal and external communications, including chats and channels, regardless of tenant origin.

These capabilities powered by Microsoft Defender will provide out-of-the-box protection as it will be enabled by default and will be available for all Teams enterprise users, with no additional configuration required. This ensures that every user benefits from advanced protection.

Figure 1: Recipient view of message warningsFigure 2: Sender view of message warnings

Empowering Users and SOC Teams

For worldwide customers with an MDO (Microsoft Defender for Office 365) P2 license or an E5 license

Security is a shared responsibility. We’re enabling users to report false negatives (FN) and false positives (FP) directly from Teams messages. These reports feed into Microsoft Defender investigation workflows, helping improve detection accuracy and reduce support overhead.

Users can now report potentially malicious messages or messages incorrectly detected as malicious directly from the message context menu in Microsoft Teams:

Report as security risk: For messages that seem suspicious but weren’t flagged.
Report as not security risk: For messages that were flagged but are actually safe.

This enables users to actively contribute to their organization's security management and protection efforts, while simultaneously enhancing the accuracy of Microsoft Defender detection controls. Reports may be submitted for both internal and external communications including chats, meetings, and channels ensuring comprehensive coverage across all collaboration platforms such as Teams web, desktop, and mobile clients. Upon submission, these reports are accessible to administrators and security operations personnel in the Microsoft Defender portal as incidents, where they can efficiently triage, investigate, and respond.

Figure 3: Report a concernFigure 4: Report a wrong detection

Holistic Visibility for Security Operation Teams

For worldwide customers with an MDO (Microsoft Defender for Office 365) P2 license or an E5 license

Security Operation teams need context, coverage, and control. That’s why we’ve introduced three new Advanced Hunting tables in Microsoft Defender designed specifically to surface Microsoft Teams message metadata and enable deep investigations across both internal and external communications.

MessageEvents: Captures metadata for all Teams messages containing URLs at the time of delivery.
MessagePostDeliveryEvents: Surfaces messages that were flagged as malicious after delivery, including Zero-hour auto purge (ZAP) actions.
MessageURLInfo: Provides granular details on URLs extracted from Teams messages.

These tables are now generally available in the Microsoft Defeder portal providing direct insight into Teams message flows.

SOC teams can now hunt across all external (federated) messages, not just messages that contain URLs. This is a major step forward in enabling cross-tenant threat detection and response, especially in today’s hybrid collaboration environments. All three tables are accessible via Advanced Hunting APIs and Streaming APIs, allowing SOC teams to integrate hunting workflows into their existing automation pipelines.

To further enhance visibility, we’ve added a new column called SafetyTip to both the MessageEvents and MessagePostDeliveryEvents tables. This column flags whether a URL warning tip was shown to the user in the Teams client, helping SOC teams distinguish between warning and block detections.

Figure 5: Hunt on message warnings

Third-party security information and event management (SIEM) solutions can also integrate with and utilize these hunting tables via the Microsoft Defender Streaming API. For instance, in Splunk, the new tables may be configured to automatically flow into your Splunk instance, supporting extended data retention by leveraging the latest version of the Microsoft Defender Splunk connector. It is important to ensure that the new Teams protection tables are selected during connector configuration to enable the continuous transfer of relevant data.

Figure 6: Connector config and version needed to connect to 3rd party SIEMs

Empower Security Teams to Act Against Threats

For worldwide customers with an MDO (Microsoft Defender for Office 365) P2 license or an E5 license

We’ve introduced a powerful new capability that gives security teams greater control and confidence when managing potential risks in Teams. With this feature, security admins can investigate suspicious conversations in Advanced Hunting and instantly remove internal users from unsafe chats, revoking their access and clearing all prior chat history to prevent further exposure. This proactive step ensures employees stay protected from threat actors and sensitive information remains secure.

The experience is streamlined through the Action Wizard, accessible directly from the Teams entity flyout, making remediation fast and intuitive. Every action is fully traceable in Action Center, providing a centralized view for monitoring and validating security interventions, while audit logs deliver records for reporting. These capabilities empower organizations to contain risks in real time, strengthen collaboration security, and maintain trust across their digital workplace.

Figure 7: remove a user from a conversation directly from the defender portal

Response capabilities for Security Teams

For worldwide customers with an MDO (Microsoft Defender for Office 365) P2 license or an E5 license

In addition to these enhanced detection, investigation and hunting capabilities, security team members are now able to perform advanced response actions for Microsoft Teams directly in the Microsoft Defender portal. Security Operations Center (SOC) analysts and admins can directly block malicious domains from within the Microsoft Defender portal, seamlessly adding targeted entries to the Teams Admin Center (TAC) blocked domains list without leaving their security workflows and switching portals. This capability enables near real-time protection when suspicious or abusive external organizations are identified. SOC teams can immediately block suspicious organizations, effectively halting new external chat messages, invites, and channel communications from those domains while deleting existing ones. These controls empower organizations to react to emerging risks in minutes, all while maintaining compliance and reducing operational overhead.

Figure 8: Block domains in Teams via TABL

Expanding Admin Quarantine and Zero-Hour Auto-Purge (ZAP) to MDO P1

We are also extending the power of Zero-hour auto-purge (ZAP) and Teams admin quarantine to even more customers, bringing this post-delivery protection layer to Microsoft Defender for Office 365 Plan 1. This reinforces our commitment to secure-by-default protection across all Microsoft Teams environments.

ZAP automatically moves malicious messages containing phishing or malware URLs from internal Teams chats and channels to admin quarantine in the Microsoft Defender portal. This post-delivery protection ensures that even if a threat evades initial detection, it can be neutralized before causing harm.

This capability will be enabled by default for all Microsoft Teams customers with Microsoft Defender for Office Plan 1, providing immediate protection without requiring additional configuration. Security admins maintain full control through the Microsoft Defender portal, where quarantined Teams messages can be reviewed, managed, and released if needed. This expansion ensures more customers benefit from continuous, automated threat removal, strengthening protection across Teams with no extra effort required

These new protections reflect our commitment to delivering security that scales effortlessly with the way people work today. By combining real-time detection, post-delivery protection, and user-driven feedback loops, we’re giving organizations the tools to stay ahead of emerging threats without slowing down collaboration.

These capabilities are engineered to operate efficiently in the background, providing assurance and proactive security measures. This enables frontline workers, IT administrators, and SOC analysts to concentrate on their core responsibilities while maintaining a secure working environment.

To learn more

I have absolutely no idea what Microsoft Defender 365 wants me to do here

JustTom — Tue, 30 Dec 2025 15:30:01 GMT

The process starts with an emal:

There's more below on the email - an offer for credit monitoring, an option to add another device, an option to download the mobile app - but I don't want to do any of the, so I click on the "Open Defender" button, which results in this:

OK, so my laptop is the bad boy here, there's that Status not of "Action recommended", with no "recommendations" and the only live link here is "Add device", something I don't need to do. The only potential "problem" I can even guess at here is that Microsoft is telling me that the laptop needs updating. Since I seldom use the laptop, only when traveling, I'd guess the next time I'd fire it up the update will occur, but of course I really don't know that's the recommended action it's warning me about, do I?

You'd expect that if something is warning you "ACTION NEEDED!!!" they'd be a little more explicit, wouldn't you?

Tenant Forwarding - Trusted ARC Sealer

weebles — Tue, 16 Dec 2025 16:57:00 GMT

As part of a tenant to tenant migration we often need to forward mail from one tenant to another. This can cause some issues with email authentication verdicts on the destination tenant. Is it possible or best practice to configure another tenant as a Trusted ARC sealer to help with forwarded email deliverability?

Strengthening calendar security through enhanced remediation

nithinnara — Mon, 24 Nov 2025 17:00:00 GMT

In today’s evolving threat landscape, phishing attacks are becoming increasingly sophisticated, often leveraging meeting invites to bypass traditional defenses. While Security Operations (SOC) teams rely on Microsoft Defender’s remediation actions to remove malicious emails, a hidden risk persists: calendar entries created by Outlook during email delivery. These entries can remain active even after the email is deleted, leaving users exposed to harmful content. This update addresses that gap.

Remediation supports cleaning up calendar entries

SOC teams currently use remediation actions such as Move to Junk, Delete, Soft Delete, and Hard Delete to quickly eliminate email threats from user inboxes. However, meeting invite emails introduce an additional challenge. Even after the email is removed, Outlook automatically creates a calendar entry during delivery, which remains accessible to users.

For example, consider a phishing email sent as a meeting invite. Despite the admin removing the email from the user’s inbox, the user can still interact with the same malicious content via the calendar entry.

This residual entry may contain harmful links or phishing content, creating a security gap. With this update, we’re taking the first step toward closing that gap. Hard Delete will now also remove the associated calendar entry for any meeting invite email. This ensures threats are fully eradicated—not just from the inbox but also from the calendar—reducing the risk of user interaction with malicious content.

This change applies to Hard Delete actions taken from any surface, including Explorer, Advanced Hunting, and API.

Note:

1) Deleted calendar entries can be restored by resending the meeting invite.

2) This action does not remove calendar entries manually added by users via .ics files.

Ability to Block URL domains via submission/TABL actions from Explorer

SOC teams can currently add senders and URLs to the TABL block list when submitting false negatives to Microsoft. However, phishing campaigns often use variations of URLs under the same parent domain, making full URL blocking less effective.

With this update, TABL options for URL domains are now dynamically surfaced, enabling SOC teams to block entire domains without leaving their workflow. This enhancement simplifies remediation and strengthens defenses against domain-based phishing attacks.

These updates strengthen SOC remediation workflows by closing critical security gaps and ensuring threats are fully neutralized across all user touchpoints. By extending remediation to calendar entries and enabling domain-level URL blocking, we deliver comprehensive protection that reduces risk, streamlines operations, and safeguards user experiences. At Microsoft, our priority is your security, and we remain committed to empowering SOC teams with tools that make defense smarter and more effective.

Learn more:

Remediate malicious email that was delivered in Office 365 - Microsoft Defender for Office 365 | Microsoft Learn

Email - Override/Bypass Events

mhmmdrn — Mon, 24 Nov 2025 10:39:23 GMT

Hi Community,

how can i extract the override/bypass informations by using EXO Powershell Module, Advanced Hunting or Graph API? I have searched in cmdlets but no luck.

Microsoft Ignite 2025: Transforming Phishing Response with Agentic Innovation

JeffreyPinkston — Tue, 28 Apr 2026 23:31:24 GMT

Phishing attacks remain one of the most persistent and damaging threats to organizations worldwide. Security teams are under constant pressure to investigate a growing number of user reported phishing emails daily, ensuring accurate verdicts and timely responses. As threats grow in volume and sophistication, SOC teams are forced to spend valuable time triaging and investigating, often at the expense of strategic defense and proactive threat hunting.

At Microsoft Ignite 2025 we are delivering innovation that showcases our continued commitment to infuse AI agents, and agentic workflows into the core of our email security solution and SOC operations to automate repetitive tasks, accelerate investigations, and provide transparent, actionable insights for every reported phishing email. In addition, we continue to invest in our ecosystem partnerships to empower customers with seamless integrations, as they adopt layered security solutions to comply with regulatory requirements, enhance detection, and ensure robust protection.

Today I’m excited to announce:

General Availability of the Security Alert Triage Agent (previously named Phishing Triage Agent)
Agentic Email Grading System in Microsoft Defender
Cisco and VIPRE Security Group join the Microsoft Defender ICES ecosystem

Note: The Phishing Triage Agent has since been expanded and is now called the Security Alert Triage Agent. Learn more at aka.ms/SATA

The Security Alert Triage Agent is now generally available

In March 2025, we introduced the Security Alert Triage Agent, designed to autonomously handle user-submitted phishing reports at scale. The agent classifies incoming alerts, resolves false positives, and escalates only the malicious cases that require human expertise. Today, we’re announcing its general availability. We will also be extending the agent to triage alerts for identity and cloud alerts.

The Security Alert Triage Agent automates repetitive tasks, accelerates investigations, and every decision is transparent, allowing security teams to focus on what matters most—investigating real threats and strengthening the overall security posture. Early results prove how it is transforming analyst work:

Identified 6.5X more malicious alerts
Improved verdict accuracy by 77%
Agent supported analysts spent 53% more time investigating real threats

Agentic email grading: Advanced analysis of phishing email submissions

When customers report suspicious messages to Microsoft, they expect clarity, speed, and actionable insights to protect their environment. They expect a response they can trust, understand easily, and take additional investigation and response action for the organization.

Previously, when customers reported messages to Microsoft, our response depended largely on manual human grader reviews, creating delays and inconsistent verdicts. Customers often waited several hours for a response, and sometimes it lacked clarity on how a verdict was reached.

Today, we are excited to announce that we integrated an agentic grading system into the Microsoft Defender submission analysis and response workflow when customers report phishing messages to Microsoft.

Image 2: Agentic Email Grading: Advanced analysis of phishing email submissions

The agentic grading system brings a new level of speed and transparency to phishing analysis. It uses large language models (LLMs) orchestrated within an agentic workflow to analyze phishing emails, assess the full content of a submitted email, and communicate context and related metadata. This system combines advanced AI with existing machine learning models and human review for additional levels of accuracy and transparency for decision making. Every verdict comes with higher quality, clear verdicts, and context-rich explanations tailored to each phishing email submission. Additionally, it establishes a feedback mechanism that enhances continuous learning and self-healing, thereby strengthening and optimizing protection over time.

By reducing reliance on manual reviews, users will experience lower wait times, faster responses and higher-quality results. It will enable security teams to respond promptly and act confidently against phishing threats.

Over time we plan to expand beyond phishing verdicts to include spam, scam, bulk, and clean classifications, making the process more comprehensive. The system will continue to evolve through feedback and adapt to emerging attack patterns.

How to view agentic submission responses in Microsoft Defender

When you report a suspicious email—whether as an admin or an end user—you can now see how Microsoft Defender’s new agentic grading system evaluates your submission. To view agentic grading system responses, follow the steps below:

Report the suspicious email
Submit the email through the admin submission or user-reported submission process.
Sign in to Microsoft Defender
Go to https://security.microsoft.com.
Navigate to Submissions
From the left menu, select:
Investigation & response > Actions & submissions > Submissions.
Choose the correct tab

Emails for admin submissions
User reported for user submissions

Open the submission details
Click the email submission you want to review. A flyout panel will display Result details.
Look for the Agentic AI note
If the verdict was generated by Agentic AI, you’ll see:
“AI-generated content may be incorrect. Check it for accuracy.”

Image 3: AI generated explainable verdicts

Expanding the Integrated Cloud Email Security (ICES) ecosystem

In June, we introduced the Microsoft Defender ICES vendor ecosystem, a unified framework that enables seamless integration of Microsoft’s Defender’s email security solution with trusted third-party vendors. Today we are excited to announce two new partners: Cisco and VIPRE Security Group.

The addition of these partners to our ecosystem reinforces our ongoing commitment to support customers in their choice to strategically layer their email security solutions. Organizations benefit from a unified quarantine experience, and a deep integration across the various SOC experiences including threat explorer, advanced hunting, and the email entity page, while providing clear insight into detection efficacy of each solution.

As we continue to innovate, our commitment remains steadfast: empowering defenders with intelligent, transparent, and integrated security solutions that adapt to the evolving threat landscape. By infusing agentic AI into every layer of Microsoft Defender, expanding our ecosystem of trusted partners, and delivering faster, more actionable insights, we’re helping organizations build resilience and stay ahead of attackers. Our strategy is rooted in delivering real value making security simpler, more effective, and adapted to the needs of every customer.

Learn More:

Want to know what else is new in Microsoft Defender at Ignite 2025 check out the blog here.
For info on how to complete admin phish submissions, please see
For end user reported phish submissions, you need to have it configured for reporting messages to Microsoft. Set it up today.

Join us at Microsoft Ignite

Join us at Microsoft Ignite to see these advancements in action and discover how intelligent, agentic defense is becoming accessible to every organization. Don’t miss our featured sessions:

AI vs AI: Protect email and collaboration tools with Microsoft Defender on Thursday, November 20^th. Learn More.

Microsoft Defender: Building the agentic SOC with guest Allie Mellen on Wednesday, November 19^th. Learn more.
Empowering the SOC: Security Copilot and the rise of Agentic Defense on Friday, November 21^st. Learn more.

Microsoft Defender for Office 365: Fine-Tuning

RenWoods — Wed, 19 Nov 2025 20:52:09 GMT

In incident response, most business email compromise doesn’t start with “sophisticated zero-day malware.” It starts with configuration gaps: forwarding mail outside the tenant, users clicking through Safe Links warnings, impersonation policies left at day-one defaults, or post-delivery cleanup still relying on a human analyst at 2:00 AM. Those gaps are what attackers actually exploit.

This blog covers our top recommendations for fine-tuning Microsoft Defender for Office 365 configuration from hundreds of deployments and recovery engagements:

Core fine-tuning actions every email or security admin should land right now
Data-driven bulk mail tuning (BCL and Bulk Mail Insights)
Impersonation and anti-phishing policy hygiene for executive protection
Automate post-delivery cleanup by enabling Automated Remediation

Each section includes a short video and practical guidance you can apply immediately in Microsoft Defender for Office 365.

These recommendations align with Microsoft’s “secure by default” direction: applying the Standard and Strict preset security policies to users, using Configuration analyzer to catch configuration drift, and enforcing least-privilege release of high-risk mail.

When possible, enable the Preset security policies to give you Microsoft’s recommended settings for Safe Links, Safe Attachments, Anti-Phishing, and Anti-Spam.

If you use custom policies (or if you exclude users from the Presets) then use Configuration analyzer regularly to compare custom policies to the Standard/Strict baselines, since those get updated as Microsoft updates the Preset policies.

Core Fine-Tuning Checklist for Defender for Office 365

This section highlights six controls we recommend implementing broadly. These are “day one hardening” items we repeatedly validate with customers.

Block automatic external forwarding by default
Attackers often create hidden inbox rules that quietly forward mail (invoices, purchase orders, wire info) to an external account they control. Use outbound spam policies to block automatic external forwarding for the entire org and then create tightly scoped exceptions only for the handful of mailboxes that legitimately need it.

This prevents data leakage and payment fraud scenarios where mail auto-forwards out of your tenant without anyone noticing. Although this setting is on by default (“System Controlled” means that external forwarding is disabled), we’ve found many tenants where this was disabled because the admin didn’t know how to create a custom policy for authorized forwarders. The trick is to order custom outbound policies to run as a higher priority than the default outbound policy which should be set to block auto-forwarded emails. It is a good idea to regularly review the auto forwarded message report (located in the Exchange Admin Center).
Use Enhanced Filtering for Connectors (“skip listing”) when necessary
If you’re routing inbound mail through a third-party Secure Email Gateway or an on-prem hop before Microsoft 365, Defender will see that intermediary as the source IP instead of the original sending IP, which degrades anti-spoofing effectiveness.Enhanced Filtering for Connectors — also called skip listing — lets Microsoft 365 look past that last hop and evaluate the real sending IP and headers, so SPF / DKIM / DMARC and anti-spam logic work correctly.

This setting does not support centralized mail routing (unless the routing is linear; see the Enhanced Filtering for Connectors learn article), so make sure you are not using that before enabling Enhanced Filtering. Centralized routing is sometimes used by organizations running a hybrid Exchange deployment, connecting Exchange Online with an on-premises Exchange Server organization.

Important: Do this instead of blanket SCL -1 transport rules that “bypass spam filtering for anything coming from our gateway.” Over-bypassing means phishing that slipped through the third-party filter can sail straight to user inboxes, which Microsoft specifically warns against.
Turn on Safe Attachments protection beyond email (SharePoint, OneDrive, Teams)
In the Safe Attachments “Global settings,” make sure Defender for Office 365 is set to protect files in SharePoint, OneDrive, and Microsoft Teams. When enabled, if a file is identified as malicious, Defender automatically locks the file in-place so users can’t open it in Teams or OneDrive. This gives you malware detonation and containment in collaboration channels, not just email.

This step closes a gap we still see a lot: customers protect mail attachments well, but shared files and Teams chats are wide open. In the 1st part of this blog series, Microsoft MVP Purav Desai describes (here) how to prevent users from downloading malicious files by running a SharePoint PowerShell cmdlet:
```
Set-SPOTenant -DisallowInfectedFileDownload $true
```
Don’t let users click through Safe Links warnings
Safe Links rewrites and time-of-click scans URLs in mail, Office apps, and Teams. In the Safe Links policy, clear “Let users click through to the original URL.” That prevents the classic “I know it says it’s malicious, but I really need to see it…” moment. Users get blocked instead of “warned but allowed.”

This setting is also enforced in Microsoft’s Standard AND Strict preset security policies where click-through is explicitly disabled.
Go beyond the default Common Attachment filter
The anti-malware policy’s Common Attachment filter blocks known dangerous file extensions (executable content, scriptable content, etc.). Microsoft ships a default list (historically 50+ high-risk extensions), and you can customize it to block additional file types common in malware delivery, like HTML droppers or password-protected archives. Messages with those file types are treated as malware and quarantined.
Do this centrally rather than relying on users to “spot a suspicious attachment.” Automation beats user judgment here.
Use custom quarantine policies that require admin approval (instead of self-release)
If you are not using the Preset Policies, you can create a quarantine policy to customize the user experience with quarantined messages. For anything phishing-related, I recommend creating a custom policy that allows the user to “request release from admin.” That means users can raise a hand if they think something should not have been quarantined, and an Incident is created for administrators to review before it is released. To me, this strikes the best balance between security and productivity.

This keeps containment intact and gives the SOC final say. It also creates an auditable workflow: who asked for release, who approved it, and why.

Bulk Mail Insights: Tune BCL using your tenant’s mail

Bulk email (“graymail”) is noisy. Payroll alerts and benefits notifications are legitimate, but they look exactly like phishing. At the same time, true marketing email (graymail) are also bulk. The traditional response (“just whitelist the sender so users stop complaining”) often opens the door for attacker-looking mail to get delivered straight to executives.

Defender for Office 365 gives you something better: Bulk Mail Insights (a.k.a. Bulk senders insight). This report shows, over the last 60 days, how much mail at each Bulk Complaint Level (BCL 1–9) was delivered vs. blocked, which senders are generating volume, and where users are likely to experience false positives or false negatives. You can interactively simulate raising or lowering the bulk threshold and immediately see, “If we tighten BCL, how many more messages get quarantined? How many of those were probably junk? How many were probably wanted?”

Why this matters:

You stop tuning bulk mail based on anecdotes and start tuning based on real telemetry from your own tenant.

You can justify decisions to leadership and audit (“We set BCL at X because here is the simulation showing false positive/false negative impact”).

You avoid blanket allow rules. Instead, you adjust bulk thresholds for legitimate high-volume senders while keeping stricter actions for everyone else.

Note: You can modify the BCL threshold in your default or custom anti-spam policy, but you can’t change it inside the Standard (BCL:6) or Strict (BCL:5) preset security policies themselves. Standard and Strict are already aligned to Microsoft’s recommended baselines.

Additional Links:

Anti-Phishing / Impersonation Tuning: Protect the people attackers actually spoof

Business email compromise very often looks like this: “Hi, can you handle this payment today?” sent from an address that looks like your CFO or CEO. Microsoft Defender for Office 365 includes targeted impersonation protection, but it only really works if you target your most targeted executives.

Here are five pitfalls we see over and over:

Empty or stale VIP list
Populate “users to protect / high value targets” with executives, finance approvers, legal, anyone authorized to move money or data. Review it monthly. Roles change, and you only get a finite number of protected users (for example, ~350 entries). An out-of-date list silently weakens protection for the people attackers actually impersonate.
Phishing email threshold stuck at 1 forever
We find organizations that are not using the preset policies have left their phishing threshold values at the default “1” because of initial false positives. We recommend raising it to match the Standard Preset (“3”) or Strict (“4”).
Weak action
If suspicious “CFO” mail just goes to Junk, users can still act on it. High-confidence impersonation of executives should be quarantined with AdminOnly or request-release workflows, not left in end-user control. Tie this back to the custom quarantine policies (discussed later in this article).
Common-name overload
If your CEO’s name is something extremely common, you’ll get noise. Expect it. Don’t “turn off” protection for that name — add that address to the Trusted Senders otherwise it will be blocked as an impersonation attempt. Use Trusted Senders / Trusted Domains for known-good partners and vendors so you keep protection high without drowning in alerts. Add only legitimate senders/domains to the Trusted Senders or Trusted Domains instead of lowering enforcement.
No scheduled review
This control can’t be “set and forget.” Put impersonation tuning and spoof intelligence review on a monthly checklist. That lets you catch new vendors pretending to be finance, new “urgent wire” lure patterns, and any drift from Standard / Strict baseline that Configuration analyzer will also call out.

When done right, impersonation protection is not just “spam reduction.” It’s payment fraud prevention.

Automated Investigation & Response (AIR): Let Defender remove malicious email before your SOC has to!

One of the biggest wins you can land quickly is letting Microsoft Defender for Office 365 automatically remove clusters of malicious messages — without waiting for analyst approval on every single item.

Here’s how it works. Defender’s Automated Investigation and Response (AIR) groups messages into “clusters” based on shared indicators like the same malicious URL or malicious file hash. If you opt in to automatic remediation for those cluster types, AIR will go find every matching copy of that threat across the tenant and soft-delete those messages, not just the one that triggered the alert.

Why this matters:

It turns post-delivery cleanup into something that happens immediately instead of “after Tier 1 has time to review.”

It removes known-bad messages from user mailboxes (and related collaboration surfaces like Teams) before a target can click.

It dramatically cuts the classic “Did anyone else get this?” manual hunt-and-purge work that burns out SOC analysts.

When you configure AIR automation settings in the Microsoft Defender portal (Settings > Email & collaboration > MDO automation settings), you’ll see checkboxes for “Similar files” and “Similar URLs.” Selecting those opts you into automatic soft delete for those clusters. Today, soft delete is the default supported action for these automatic remediations, enabling administrators to undo a deletion, if necessary.

This is Defender for Office 365 Plan 2 / Microsoft 365 E5 functionality, and it’s exactly the kind of “secure operations by default” Microsoft has been pushing: detect, contain, and clean up automatically, then let humans investigate with context instead of manually chasing every copy of a phish.

This automation triggers when malicious clusters are detected. For automating the classification and triage of user-submitted phishing incidents, check out the Security Copilot Phishing Triage Agent (Preview).

Additional Links:

Final Thoughts

Defender for Office 365 is more than “email filtering.” It’s part of your security operations surface. The decisions you make about automated remediation (AIR), bulk mail thresholds, Safe Links/Attachment behavior, outbound forwarding, connector hygiene, quarantine policy, and impersonation tuning directly determine how easy — or how hard — it is for an attacker to penetrate your organization.

Microsoft’s current guidance is clear:

Apply Standard or Strict preset security policies so users get the recommended protections by default (for example, Safe Links with no click-through).

If you must use a custom policy, review the recommendations from the Configuration analyzer monthly for new recommendations, or to catch and correct drift whenever someone weakens a control.

Align internal procedures with the excellent Security Operations Guide for Defender for Office 365.

Lock down quarantine so only admins can release high-risk messages, with an auditable “request release” path for users.

Turn on automated remediation so Defender can remove malicious clusters of messages before anyone clicks.

Organizations that land these basics are in a dramatically better position during an incident. Instead of “Who clicked the link?” you can say, “AIR already pulled it, users were blocked from clicking through, outbound forwarding is disabled, and impersonation of the CFO is quarantined for admin review.” That’s what “secure by default” actually looks like in production.

________
This blog was authored by Joe Stocker, Microsoft Security MVP and Founder of Patriot Consulting Technology Group, in partnership with the Microsoft Defender for Office 365 product team, including Paul Newell, Senior Product Manager, Microsoft Defender for Office 365.

Joe Stocker
Microsoft Security MVP

Learn More and Meet the Author

1) December 16th Ask the Experts Webinar:

Microsoft Defender for Office 365 | Ask the Experts: Tips and Tricks (REGISTER HERE)
DECEMBER 16, 8 AM US Pacific

You’ve watched the latest Microsoft Defender for Office 365 best practices videos and read the blog posts by the esteemed Microsoft Most Valuable Professionals (MVPs). Now bring your toughest questions or unique situations straight to the experts. In this interactive panel discussion, Microsoft MVPs will answer your real-world scenarios, clarify best practices, and highlight practical tips surfaced in the recent series. We’ll kick off with a who’s who and recent blog/video series recap, then dedicate most of the time to your questions across migration, SOC optimization, fine-tuning configuration, Teams protection, and even Microsoft community engagement. Come ready with your questions (or pre-submit here) for the expert Security MVPs on camera, or the Microsoft Defender for Office 365 product team in the chat! REGISTER NOW for 12/16.

2) Additional MVP Tips and Tricks Blogs and Videos in this Four-Part Series:

Microsoft Defender for Office 365: Migration & Onboarding by Purav Desai
Safeguarding Microsoft Teams with Microsoft Defender for Office 365 by Pierre Thoor
You may be right after all! Disputing Submission Responses in Microsoft Defender for Office 365 by Mona Ghadiri
(This post) "Microsoft Defender for Office 365: Fine-Tuning" by Joe Stocker

Learn and Engage with the Microsoft Security Community

Log in and follow this Microsoft Defender for Office 365 blog and follow/post in the Microsoft Defender for Office 365 discussion space.
- Follow = Click the heart in the upper right when you're logged in 🤍
Learn more about the Microsoft MVP Program.
Join the Microsoft Security Community and be notified of upcoming events, product feedback surveys, and more.
Get early access to Microsoft Security products and provide feedback to engineers by joining the Microsoft Customer Connection Community.
Join the Microsoft Security Community LinkedIn

You may be right after all! Disputing Submission Responses in Microsoft Defender for Office 365

RenWoods — Wed, 19 Nov 2025 14:59:01 GMT

Introduction

As a Microsoft MVP (Most Valuable Professional) specializing in SIEM, XDR, and Cloud Security, I have witnessed the rapid evolution of cybersecurity technologies, especially those designed to protect organizations from sophisticated threats targeting email and collaboration tools. Microsoft Defender for Office 365 introduced an LLM-based engine to help better classify phishing emails that, these days, are mostly written using AI anyways about a year ago. Today, I'm excited to spotlight a new place AI has been inserted into a workflow to make it better…a feature that elevates the transparency and responsiveness of threat management: the ability to dispute a submission response directly within Microsoft Defender for Office 365.

Understanding the Challenge 

While the automated and human-driven analyses are robust in Defender for Office 365, there are occasions where the response—be it a verdict of "benign" or "malicious"— doesn’t fully align with the security team's context or threat intelligence. If you are a Microsoft 365 organization with Exchange Online mailboxes, you’re probably familiar with how admins can use the Submissions page in the Microsoft Defender portal to submit messages, URLs, and attachments to Microsoft for analysis.  As a recent enhancement, now all the admin submissions use LLM based response for better explainability.

In the past, disputing such verdicts required separate support channels, using Community support, or manual email processes, often delaying resolution and impacting the speed of cyber operations.

 Introducing the Dispute Submission Response Feature 

With the new dispute submission response feature, Microsoft Defender for Office 365 bridges a critical gap in the incident response workflow. Now, when a security analyst or administrator receives a verdict on a submitted item, they have the option to dispute the response directly within the Microsoft 365 Defender portal. This feature streamlines feedback, allowing teams to quickly flag disagreements and provide additional context for review at the speed of operations. 

  How It Works 

Upon submission of a suspicious item, Microsoft Defender for Office 365 provides a response indicating its assessment—malicious, benign, or other categorizations. 
If the security team disagrees with the verdict, they can select the "Dispute" option and submit their rationale, including supporting evidence and threat intelligence. 
The disputed case is escalated directly to Microsoft’s threat research team for further review, and the team is notified of progress and outcomes.

This direct feedback loop not only empowers security teams to advocate for their organization's unique context, but also enables Microsoft to continually refine detection algorithms and verdict accuracy based on real-world input, because security is a team sport.

Benefits for Security Operations 

Faster Resolution: Streamlined dispute submission eliminates the need for external support tickets and escalations, reducing turnaround time for critical cases.

Greater Transparency: The feature fosters a collaborative relationship between customers and Microsoft, ensuring that verdicts are not final judgments but points in an ongoing dialogue.

Continuous Improvement: Feedback from disputes enhances Microsoft’s threat intelligence and improves detection for all Defender for Office 365 users.

Empowerment: Security teams gain a stronger voice in the protection of their environment, reinforcing trust in automated defenses.

MVP Insights: Real-World Impact 

Having worked with global enterprises, I’ve seen how nuanced and context-specific threats can be. Sometimes, what appears benign to one organization may be a targeted attack for another, a slight modification to a URL may catch one email, but not others, as slight changes are made as billions of emails are sent. We are only as good as the consortium. The ability to dispute submission responses creates a vital safety net, ensuring that security teams are not forced to accept verdicts that could expose them to risk. It’s a welcome step toward adaptive, user-driven security operations. 

Conclusion 

The dispute submission response feature in Microsoft Defender for Office 365 is one of the most exciting features for me, because it focuses on enabling organizations striving for agility and accuracy in threat management. By enabling direct, contextual feedback, Microsoft empowers security teams to play an active role in shaping their defenses. As an MVP, I encourage all users to leverage this feature, provide detailed feedback, and help drive the future of secure collaboration in the cloud. You may be right after all.  

_________
This blog has been generously and expertly authored by Microsoft Security MVP, Mona Ghadiri with support of the Microsoft Defender for Office 365 product team.

Mona Ghadiri
Microsoft Security MVP

Learn More and Meet the Author

1) December 16th Ask the Experts Webinar:

Microsoft Defender for Office 365 | Ask the Experts: Tips and Tricks (REGISTER HERE)
DECEMBER 16, 8 AM US Pacific

2) Additional MVP Tips and Tricks Blogs and Videos in this Four-Part Series:

1. Microsoft Defender for Office 365: Migration & Onboarding by Purav Desai

2. Safeguarding Microsoft Teams with Microsoft Defender for Office 365 by Pierre Thoor

3. (This blog post) You may be right after all! Disputing Submission Responses in Microsoft Defender for Office 365 by Mona Ghadiri

4. Microsoft Defender for Office 365: Fine-Tuning | Real-world Defender for Office 365 tuning that closes real attack paths by Joe Stocker

Learn and Engage with the Microsoft Security Community

Log in and follow this Microsoft Defender for Office 365 blog and follow/post in the Microsoft Defender for Office 365 discussion space.
- Follow = Click the heart in the upper right when you're logged in 🤍
Learn more about the Microsoft MVP Program.
Join the Microsoft Security Community and be notified of upcoming events, product feedback surveys, and more.
Get early access to Microsoft Security products and provide feedback to engineers by joining the Microsoft Customer Connection Community.
Join the Microsoft Security Community LinkedIn

Ensure your ICES solution works seamlessly alongside Microsoft Defender

JeffreyPinkston — Thu, 06 Nov 2025 04:36:32 GMT

In today’s evolving threat landscape, organizations increasingly rely on layered email security solutions to protect users and sensitive data. Microsoft supports and collaborates with Integrated Cloud Email Security (ICES) vendors that work in conjunction with Microsoft Defender, and customers who choose a layered approach to email security to ensure the maximum level of email protection.

It is, however, key that when integrating ICES solutions with Microsoft Defender, to follow best practices to maximize security and operational efficiency.

In this blog, we explain these best practices in more detail and outline three other routing techniques commonly used across ICES vendors. This will allow organizations to understand the impact of non-standard mail routing configurations on their security operations (SOC) effectiveness and partner with their ICES vendors on the best approach.

Best practices for ICES vendor integration

Microsoft has outlined best practices for third-party solutions integrating with Microsoft 365, where recommended and supported approaches include DNS mail routing or the Graph API. This article provides more details on these approaches and also outlines integration techniques that we do not recommend. By using these best practices, any 3rd party email security vendor can ensure that their solution works seamlessly alongside Microsoft Defender. In addition, we recently launched the Microsoft Defender ICES vendor ecosystem. This gives partners an additional option for integration, where we partner directly with the solution provider to build a deeper integration between the ICES solution and Microsoft Defender. We harmonize telemetry, email verdicts, security policies, and more, to provide joint customers with optimized protection and SOC workflows in the Defender portal.

Non-standard email routing techniques used by ICES vendors

We know that as the ICES space evolved, several vendors integrated with Microsoft Exchange using non-standard email routing techniques, such as journaling, connector-based routing, and post-delivery actions. These functions were originally designed for different purposes. When deployed alongside Microsoft Defender, these integration approaches can introduce unique complexities for mail flow and SOC operations. Understanding how these techniques work and their potential impact is essential for making informed decisions about your organization’s email security architecture and are outlined below.

Journaling for email security benchmarking

Email journaling (Figure 1) is a legacy Exchange Online feature originally designed for archiving and to help organizations meet legal, regulatory, and organizational compliance requirements by recording inbound and outbound email communications.

While journaling was designed for archiving and similar use cases, we know that various ICES vendors utilize journaling rules to route emails to the vendor’s test environment to evaluate the effectiveness of their solution. Journaling occurs before Defender filtering, so both solutions act independently and partially, complicating operational clarity for SOC teams.

This approach can lead to duplicate catch scenarios, therefore misstating the unique catch rate of the ICES vendor. If a journaled copy of a phishing email is routed to an ICES vendor, this occurs before it was filtered by Microsoft Defender. Consequently, both Microsoft Defender and the ICES vendor now simultaneously assess the message, and both solutions may act on it independently. This often results in duplicate catch scenarios and creates ambiguity around which solution blocked the threat, ultimately making it challenging to assess the true effectiveness of each layer. Some ICES vendors may consider every email they filter “a miss by Microsoft Defender”. However, as journaling occurs before Defender filtering, it’s generally an incomplete representation.

Therefore, we do not recommend the implementation of journaling for benchmarking or operational clarity purposes of ICES vendor solutions that operate next to Microsoft Defender.

Journaling + post-delivery actions

Some vendors combine journaling with post-delivery actions via Graph API or Exchange Web Services (EWS). This approach enables them to take remediation actions on emails after they have been delivered to users’ mailboxes, such as moving messages to the Junk folder or adding labels to alert users of potential threats. However, if Defender quarantines a message first, the ICES vendor may not be able to perform these actions, limiting their impact. Furthermore, when a vendor deletes and recreates a message using EWS, it can result in duplicate message IDs, which fragments SOC visibility and slows incident response. As a result, these configurations should be avoided, as they can lead to unreliable investigations and operational complexity.

Connector-based implementations

Connectors are typically used to route mail between Exchange Online and on-premises or non-Microsoft systems. Some vendors repurpose this mechanism to:

Route messages out of Exchange Online after Microsoft Defender filtering.

Apply their own filtering.

Reinject the message as a new email.

Using connectors to send messages out of Exchange Online after Microsoft Defender filtering, apply additional vendor filtering, and then return them as new emails introduces major operational risks. Reinjecting messages strips the original sender authentication context (SPF, DKIM, DMARC), which can lead to false positives, duplicate quarantines, and inconsistent reporting across tools like Explorer, Advanced Hunting, and Message Trace in Microsoft Defender. With this configuration, SOC teams may see multiple message IDs for the same email, making it difficult to correlate events and accurately track message disposition. This also impacts post-delivery protections such as Zero-hour Auto Purge, which may fail or be misapplied. These issues increase investigation time, reduce visibility, and can undermine existing protections, impacting the overall security of an

organization. That’s why our documentation states that we strongly recommend avoiding this configuration.

When assessing statistics or performance claims about Microsoft Defender’s effectiveness, it’s important to keep in mind how deployment configurations can shape outcomes. As outlined above, techniques such as journaling, connector-based routing, and post-delivery actions may introduce complexities that affect how performance is measured. These integration approaches can result in discrepancies within metrics, making it challenging to accurately attribute detections or gauge overall effectiveness. It is essential for security leaders and SOC teams to interpret results and make informed decisions about your organization’s email security posture.

Microsoft’s commitment to effective ICES vendor integration

By understanding the impact of the various integration techniques, security leaders can ensure their layered email security delivers streamlined SOC workflows and the highest level of protection for email.

Microsoft is committed to working collaboratively with all ICES vendors to help them embrace best practices in integrating with Microsoft Exchange so they can work effectively alongside Microsoft Defender. Whether using the documented best practices with Microsoft Exchange or joining the Defender ecosystem to build an even deeper integration, either approach will help ensure that the solutions work seamlessly alongside Microsoft Defender.

Learn more

Integration best practices

Microsoft Defender ICES vendor ecosystem

Email security effectiveness benchmarking