detection

23 Topics

DMARC, DKIM, SPF none but Composite authentication pass
Hi all, I have a email where DMARC, DKIM, SPF are marked as None, but still Composite authentication as passed. How can this be since the info of the composite authentication says: Combines multiple types of authentication such as SPF, DKIM, DMARC, or any other part of the message to determine whether or not the message is authenticated. If all three are none, what other part of the messages lets the message to pass composite authentication?
Solved
Gunter Danzeisen
Aug 04, 2022 Place Microsoft Defender for Office 365
15KViews
0likes
4Comments
Enable Quarantine Notifications for Strict protection (Strict Preset Security Policy)
How can I enable quarantine notifications for the preset strict protection policies. There is no way to assign a quarantine policy to strict protection policies.
Solved
Kiril
Dec 07, 2022 Place Microsoft Defender for Office 365
11KViews
0likes
19Comments
Moving mx records to O365
Hello We are medium sized company, around 7000 mailboxes. We own several domains that we accept email for. Currently all mx records point to IronPorts. The emails are go through the messaging hygiene at the ironports and then the message is delivered to Exchange online. We want to move all mx records to O365. What i would like to understand, is what is the best strategy to do this? Should i move a domain that doesn't receive a high volume of mail traffic first. I think doing this will allow for fine tuning of the O365 filtering polices, and give us me some indication regarding how successful the move was and what the success rate will be for future domain moves. Also how should i construct my anti spam, anti malware polices? Should i start with the using Preset Security Policies" ? My concern with using the preset policies is you cant edit them. We will have a lot of safe and blocked senders that we will need to export from the IronPort's and import into O365. If i cant edit preset polices, then what is my best course of action? will i need to create custom polices ? I know these are a lot of questions. I'm trying to understand how i should construct the roadmap or process for moving domains to O365 Thank you
Solved
skipster311-175
Jun 14, 2022 Place Microsoft Defender for Office 365
9.1KViews
0likes
6Comments
Defender for O365 with onprem mailboxes
Hi all, Just wanted to confirm the usability of some features of Defender for O365 when having a exchange hibrid scenario but still most of the mailboxes on-prem. From my understanding not all features will work Safe Attachments (dynamic delivery will not work for onprem mailboxes) Safe Links (works if the MX is pointing to EOP) ATP for SharePoint, OneDrive, and Microsoft Teams (not applicable to EXO) ATP anti-phishing protection (not sure if all settings will work for onprem mailboxes) Real-time detections (reports) Thanks in advanced, Rgs RM
Ricardo Mendes
Oct 16, 2020 Place Microsoft Defender for Office 365
6.2KViews
0likes
1Comment
Defender for Office Policy Assignment by Domain
Hello - Sorry, this is a little bit long... We've been testing MDO and have run into an issue that seems like a 'bug' but, I've been unable to find any other reports of it online. I have a ticket open with MS but, that's moving along very slowly as they're insistent on re-doing all the troubleshooting I've already done. But, I digress... The problem we've found is in the MDO policy assignment - confirmed in anti-phish and anti-malware. If I assign the policy to a user and/or group/DL, the policy works as expected. However, if I use the domain assignment (as we were hoping to do for the full deployment), the assigned policy is being ignored and the message(s) is being passed on to the Default policy. For example, I have a custom anti-malware policy that's my priority 0 policy. In it, I have assigned a specific group with some test accounts. I also assigned a domain (one of my owned/registered tenant domains). I also added a specific file extension to the disallowed list so that I could test. Then, I send a test email, with an attachment with that extension, to an account that's a member of the assigned group as well as another account that's a member of the assigned domain. The expectation is that both of those messages should be blocked. However, that's not the case. The message to the account that's part of the assigned group is blocked (as expected) but, the message to the accounts that's part of the assigned domain is successfully delivered (attachment and all). It doesn't seem to matter which accounts, groups or domains I use, I can readily repeat the issue everytime. As an additional test, I added a random extension to the block list of the Default malware policy - one that's not included in my custom policy - and sent test emails again with an attachment of that file type. The expectation being that all accounts should receive the message. But, nope, that's not what happened. The account(s) assigned to the custom policy by group/account received the message (as expected) and the one assigned by domain was blocked. To me, that's pretty clear evidence that there's some kind of issue with domain assignment in the policies. That particular message basically bypassed the policy to which it was assigned and was handled by the Default policy. As mentioned, I haven't found any other similar reports online, and to this point, Microsoft hasn't alluded to any issues. Surely others are using domains to assign their MDO policies. Has anyone run into this and, if so, have you found some sort of resolution for it? Thanks, Robin
Solved
robinhailey
Feb 09, 2024 Place Microsoft Defender for Office 365
2.6KViews
0likes
10Comments
capability to detect password protected files to during the email delivery and ZAP process of the e
Does M365 Defender & EOP has capability to detect password protected files to during the email delivery and ZAP process of the email in user mailbox? If yes how we can configure to stop such emails and put them into quarantine and stop the email delivery to end users? I have another follow-up question on this is that if we deploy this Transport rule to quarantine false or parked domains emails like phishing or spam and unwanted emails then how we would filter and allow the legit email domains to send out such files like .PDF, Docs, excel and other password protected files to users mailbox without putting them into Quarantine?
VinodS2020
Dec 11, 2023 Place Microsoft Defender for Office 365
2.5KViews
0likes
3Comments
ASF Advanced Spam Filter roadmap
For the last year or so I have been seeing notes in Microsoft documentation advising that Exchange Online ASF is being deprecated. Do we have a roadmap for this, and more importantly any news about the replacement features elsewhere in the product. I am particularly interested in -IncreaseScoreWithNumericIps; the capability to spot and act on hyperlinks identifying a host by its numeric IP address. Failing clarity on that question, does anyone have a "pattern" they can recommend that can survive the depredations of Safe Links? I apologise for the cross-post from the Exchange community, but it is not completely clear where this topic should be discussed.
ExMSW4319
Mar 01, 2022 Place Microsoft Defender for Office 365
2KViews
0likes
0Comments
What do we do with Click information?
If the "tracks user clicks in supported Office 365 apps." setting is enabled, what are the recommended good practices for using the data that this generates?
Dean_Gross
Apr 10, 2021 Place Microsoft Defender for Office 365
1.5KViews
0likes
1Comment
URL clicks not being tracked
Hi, I have url rewrite and defender EDR in the environment. It seems like clicks are missing tracking information. Both in hunting queries and the actual url and domain page show no clicks and i know for a fact users clicked it. URL is external and it is rewritten, i checked in the email to confirm, i even clicked the url myself and nothing is tracked. Also how do you translate a rewritten url to url without clicking on it? Any suggestions?
danc186
Jan 16, 2024 Place Microsoft Defender for Office 365
1.4KViews
1like
2Comments
use custom RBL list in ATP\EOP
Hello We are using EOP\ATP in exchange online. Is it possible to configure EOP\ATP to use a custom rbl list ? Also what rbl lists does EOP\ATP use ?
Skipster311-1
Oct 23, 2021 Place Microsoft Defender for Office 365
1.3KViews
0likes
0Comments