Disable Direct Send in Exchange Online to Mitigate Ongoing Phishing Threats
Direct Send allows devices and applications to send unauthenticated emails over port 25 directly to Exchange Online. While this may support legacy devices like printers or scanners, it also opens the door for threat actors to deliver spoofed emails without authentication. These messages often appear to come from trusted internal sources, making them especially dangerous. To reduce your organization’s exposure to this threat, it's strongly recommended to disable Direct Send using Microsoft’s newly introduced RejectDirectSend setting. You can quickly enable this setting using PowerShell: Connect-ExchangeOnline Set-OrganizationConfig -RejectDirectSend $true If you still have devices or applications that need to send emails, use authenticated SMTP submission or set up connector-based routing with certificate or IP restrictions.Exchange Online Protection modifying MIME parts of inbound messages
Is it normal for Exchange Online Protection to modify the body of messages in transit? It seems like this would break DKIM, S/MIME, and PGP signatures, among other concerns. Body of message in transit, as enqueued to Exchange Online Protection --f403043c34cc657e800562729e22 Content-Type: text/plain; charset="UTF-8" test 123 --f403043c34cc657e800562729e22 Content-Type: text/html; charset="UTF-8" <div dir="ltr">test 123</div> --f403043c34cc657e800562729e22-- Body of message after processed by Exchange Online Protection --f403043c34cc657e800562729e22 Content-Type: text/plain; charset="UTF-8" X-Microsoft-Exchange-Diagnostics: 1;BN6PR05MB2833;27:Kggba7aJSKdGRUbWQbPxXD6C/Sek7kTm9NiDQTjQ4dXJqlkZ74IZBgkd+mj0Y+pXNC/C5iEbJImUyYsMJ4cZzQcKg3+bNgqEWYXZIQb7hV7hnAr4EPNNG+G8E3Mr4Jh4 X-Microsoft-Antispam-Message-Info: fRiLCE20IMgZ5HIhJaOajYDVyoaLHNGwogh7E3vvNj1oJoMf114SUWJlNk7kgN1/ test 123 --f403043c34cc657e800562729e22 Content-Type: text/html; charset="UTF-8" X-Microsoft-Exchange-Diagnostics: 1;BN6PR05MB2833;27:Kggba7aJSKdGRUbWQbPxXD6C/Sek7kTm9NiDQTjQ4dXJqlkZ74IZBgkd+mj0Y+pXNC/C5iEbJImUyYsMJ4cZzQcKg3+bNgqEWYXZIQb7hV7hnAr4EPNNG+G8E3Mr4Jh4 X-Microsoft-Antispam-Message-Info: fRiLCE20IMgZ5HIhJaOajYDVyoaLHNGwogh7E3vvNj1oJoMf114SUWJlNk7kgN1/ <meta http-equiv="Content-Type" content="text/html; charset=utf-8"><div dir="ltr">test 123</div> --f403043c34cc657e800562729e22--Meaning of 365 Mail Security's "SFS" Header Field
I've seen quite a few threads in various forums with this question. I'm trying to troubleshoot a message that was quarantined. The provided information doesn't contain any justification for the spam verdict. There is one field that might have an answer, however I can't find any official documentation on it. That's the SFS field. This page: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/message-headers-eop-mdo?view=o365-worldwide contains definitions for all of the header fields *except* the SFS field. The SFS field contains nothing but a long list of numerical codes. I'm inclined to think that these codes represent the reasons a message was marked spam. I saw a request for a list of definitions for the SFS codes in GitHub that was marked "resolved," "merged," and then deleted. That's concerning because the ticket it was merged into had a link to the document, but did not contain the requested information after all. I'm going to just assume it was an oversight on the part of tech working on the documentation: https://webcache.googleusercontent.com/search?q=cache:bMqVZtmJ-eUJ:https://github.com/MicrosoftDocs/microsoft-365-docs/issues/740&hl=en&gl=us Any chance we can get some information on the SFS field in order to properly troubleshoot quarantined messages? It seems pretty important, and really strange that the info is so hard to find.Reporting on EOP/MDO Spam Confidence Levels of "Moved to Junk" and Quarantined messages
I'm working with a client who use customized Anti-Spam policy settings, and are considering moving over to the Standard Preset Policies instead. One difference between the two things is that their current config only does MoveToJmf for HighConfidenceSpam, while Standard preset does Quarantine. They would like to know how many spam vs highconfidencespam they're getting. I find no report options (GUI/PowerShell) that offer this visiblity. I know that Get-QuarantineMessage / Quarantine GUI both show this level of detail. But nothing else does. Since the Quarantine is only good for Quarantined messages (doesn't help with MoveToJmf'd messages), I'm hoping there is some way to retrieve the SCL score or just the classification of spam or highconfidencespam. Does anyone know of a way to get this info at scale?
Does it possible to know the emails that's rejected at the edge/perimeter of EOP(Defender for o365)?
Does it possible to know the emails that's rejected at the edge/perimeter of EOP(Defender for o365)? As the email get rejected at edge level, does it possible to know from which sending IP emails got rejected in Defender for o365 portal ?
