MVP Champ Spotlight- Pierre Thoor
Pierre is recognized as a Most Valued Professional (MVP) by Microsoft as an exceptional community leader for their technical expertise, leadership, speaking experience, online influence, and commitment to solving real-world problems. Learn more about MVPs and what it takes to become one here: FAQ | Most Valuable Professionals. Within our Security MVPs, Microsoft has hand-selected some of our top collaborative MVPs with a passion for working directly with the Product Group to share community insights with Microsoft and co-create content to help address the community needs. Read the interview below! Picture of Pierre celebrating the publication of his book: Microsoft Defender for Identity in Depth. Link to check it out: https://www.amazon.com/Microsoft-Defender-Identity-Depth-cyberattack/dp/B0DK1HW2KX Personal Story and Credibility Q: Tell us a bit about your role and background: how did you become focused on email security and Microsoft Defender for Office? A: I began my career in 3rd line Windows Server support, where I first developed an interest in cybersecurity through Windows patch management. A few years later, I became more focused on Microsoft Exchange Server and securing mail flow. As the industry moved into Office 365 and Exchange Online, email protection kept improving, but it also became clear to me that email remained the number one attack vector. Most incident response cases I was involved in had a phishing or malicious email component. That’s when I realized that strengthening defenses around email could reduce a huge percentage of overall risk. Microsoft Defender for Office (MDO) naturally became my focus, not just because it protects email, but because it connects detection, protection, and response across the Microsoft 365 ecosystem. Over time, I’ve worked with everything from MDO deployment strategies and securing Microsoft 365 and Azure services to building SOC playbooks, and it’s grown into a real passion area for me. Q: What’s been your proudest moment as a security practitioner where MDO played a critical role? A: My proudest moments are when I can clearly see that MDO has stopped something dangerous before it reached users. For example, watching a phishing campaign get blocked at scale and being able to trace that in the reporting gives real proof that the protections are working as intended. It’s not about one single incident, but about seeing the technology deliver measurable protection in day-to-day use. Blueprint 1: Deployment and Adoption Strategy Q: When organizations are just starting with MDO, what are the first three steps you recommend for a successful rollout? A: I usually recommend three key steps for a successful rollout: Start with email authentication and baseline hygiene. Make sure SPF, DKIM, and DMARC are properly configured, and that your MX records point to Exchange Online. This ensures that MDO has the right signals to work effectively. Run a pilot with Preset Security Policies. Use Microsoft’s Preset Security Policies (Standard or Strict) instead of relying on the default built-in protections. The defaults are often mistaken for being “secure enough”, but they leave important gaps. Start with a smaller pilot group, validate the impact, and make sure you as an admin understand the order of precedence between preset and custom policies. This prevents misconfigurations when you scale out. Leverage hunting and reporting early. Get familiar with the hunting tables in advanced hunting and the reporting capabilities in MDO. Even in the first 30–60 days, learning how to use Threat Explorer, submission reports, and campaign views will give you strong visibility and confidence in the rollout. Q: What common mistakes or misconceptions do you see teams make when deploying MDO? A: One of the most common mistakes I see is treating MDO as a “set it and forget it” product. As an SOC analyst or security administrator, you really need to understand the settings and continuously monitor what types of emails are entering your organization. Another common gap is not using the submission process effectively. Submitting false positives and false negatives is critical, because those signals feed directly back into Microsoft’s protection systems. The machine learning models behind MDO are continuously retrained on customer submissions, which means your input not only improves your own tenant’s protection but also strengthens detections globally. I also see organizations overlook the threat hunting side of MDO. Knowing the advanced hunting tables connected to email, such as EmailEvents, EmailUrlInfo, and EmailAttachmentInfo, is key for proactive defense. These give you the ability to trace campaigns, investigate suspicious patterns, and connect email telemetry with other Defender signals. Finally, many organizations still rely only on the Default Built-in Protection, instead of moving to Preset Security Policies (Standard or Strict) or creating custom ones. On top of that, administrators often don’t understand the policy precedence, and that lack of awareness can leave real gaps in how email is filtered and protected. Q: Can you share your own checklist or framework for configuring MDO to get quick wins in the first 30–60 days? A: In the first 30–60 days, I focus on quick wins that build a strong foundation and give early visibility. My checklist looks like this: Establish the foundation Configure email authentication: SPF, DKIM, and DMARC. Enable Preset Security Policies (Standard at minimum). If you’re using custom policies instead, make sure quarantine policies are in place. Understand policy precedence and configure the Tenant Allow/Block List (TABL). Secure collaboration and file sharing Enable Safe Links and Safe Attachments for all users. Turn on Zero-hour Auto Purge (ZAP) for Teams. Prevent users from downloading malicious files in OneDrive, Teams, and SharePoint Online. Set up administration and controls Enable and understand Unified RBAC to control who can manage MDO and investigate emails in Threat Explorer. Use Configuration Analyzer or the ORCA PowerShell module to validate your setup against best practices. Build operational processes Establish a clear submission process for false positives and false negatives. Review Threat Explorer weekly to build familiarity with reporting and investigation. Expand into hunting and alerting Learn the key advanced hunting tables related to email. Build custom KQL-based alerts in Defender XDR to fit your organization’s workflows. Blueprint 2: Operational Excellence Q: What features or policies have given your SOC team the biggest efficiency gains? A: The features that have given the biggest efficiency gains are Automated Investigation and Response (AIR) and adopting the Strict Preset Security Policies. With AIR, user-reported phishing emails automatically trigger an investigation playbook. The system checks details such as the sender, sending infrastructure, whether similar messages exist in the tenant, and if the campaign is already known. Safe submissions are automatically cleared, while risky ones are enriched with recommended remediation steps. This greatly reduces noise and makes investigations faster and more consistent. Moving to Strict Preset Policies also had a major impact. Instead of relying on the weaker default protections, Strict presets raise the security baseline and block more threats up front, which reduces the overall number of alerts and investigations needed. Q: Could you walk us through one or two “playbooks” that your team uses to detect, respond, and remediate email threats? A: One of our main playbooks is for a compromised user or mailbox. It starts with an incident in Defender XDR, and then we trigger our automation built on Azure Durable Functions. The automation checks for unusual sign-ins in Entra ID, forces a password reset, revokes active tokens, and resets MFA methods. It also reviews mailbox rules for suspicious changes and if the user is blocked from sending email, sends an SMS to the end user with next steps, and finally logs all actions back into the incident for visibility. Blueprint 3: Driving Business Outcomes Q: How do you measure and report the value of MDO back to business stakeholders? A: We highlight MDO’s business value using the Microsoft Defender for Office 365 Overview dashboard, which provides clear, visual metrics, like threats blocked before delivery, items purged post-delivery via ZAP, and any “uncaught” threats. The dashboard also gives insights into phishing, malware, spam, impersonation detections, and risky allows. These visuals help business stakeholders quickly understand how email threats are being prevented, and where improvements are needed. Q: What metrics or KPIs should every MDO practitioner track to prove success? A: For me, the most important KPIs in MDO are: Efficacy – percentage of malicious emails blocked before delivery vs. those removed after delivery. User resilience – phishing click rate and volume of user-reported messages. Operational performance – mean time to detect and remediate email threats. Quality of tuning – false positive and false negative rates. Blueprint 4: Scaling and Maturing Use Q: Once the basics are in place, what’s the path to advanced adoption? A: Once the basics are in place, the path to advanced adoption usually looks like this: Move from presets to custom policies – Microsoft recommends Preset Security Policies, but if your organization requires customization, make sure every user is still covered and protected. Enable Automated Investigation and Response (AIR) – to take advantage of Microsoft’s built-in automation for user-reported phishing and other alerts. Build additional automation playbooks – for example, in Logic Apps (or use Azure Functions), to integrate MDO signals into wider incident response workflows. Use Attack Simulation Training – to measure user resilience and strengthen awareness against phishing. Develop a SecOps guide for MDO – either adopt Microsoft’s guidance or create your own playbook for how to operate MDO in daily security operations. Q: How do you expand MDO’s impact across other tools or workflows (e.g., integration with SIEM, automation)? A: I expand MDO by treating it as a signal source in a SOAR pattern. MDO alerts/events flow into Defender XDR/Sentinel, which trigger Durable Functions. We fan-out to parallel tasks (enrichment, checks, and lookups), then fan-in to make a single decision and take actions. This turns MDO from just email protection into part of an automated response pipeline that also touches identity, endpoints, and collaboration tools. Q: What’s one advanced scenario you’ve implemented that other practitioners could replicate? A: One advanced scenario I’ve implemented is using MDO alerts to trigger an automated workflow in Azure Durable Functions. When a suspected phishing campaign is detected, the workflow enriches the signal with external intelligence sources like PhishTank for URL reputation and VirusTotal for file and hash lookups. From there, it decides on actions such as bulk-removing similar emails, updating the Tenant Allow/Block List, or notifying the SOC in Teams. Other practitioners could easily replicate this pattern, and even extend it with tools like ANY.RUN for sandboxing suspicious attachments. Blueprint 5: Community and Advocacy Q: Why do you want to share your experiences with the wider community? A: I believe sharing is caring – knowledge should be shared. Products like MDO can be complex, and it’s not always obvious how the settings actually work in practice. By sharing my own experiences and lessons learned, I try to make it easier for others to understand the product and configure it the right way. And at the same time, I also learn from the community. In the end, sharing is caring, if I can make MDO easier for someone else, then we all win. Q: One “field lesson” for every new MDO user? A: One field lesson I’d share is: don’t just turn MDO on and leave it. Take the time to understand how the features and settings really work, and share that knowledge with others. The product is powerful, but the real value comes when we as practitioners explain the ins and outs so others can avoid common mistakes. For me, sharing those lessons is just as important as learning them. Q: How can others follow your blueprint to adopt MDO effectively and become champions? A: To adopt MDO effectively, start simple: enable Preset Security Policies, make sure email authentication is in place, and build a process for handling submissions. From there, grow step by step, learn the product, get familiar with the hunting tables, and refine policies so they fit your organization. To become a champion, don’t keep that knowledge to yourself. Share your experiences, what worked and what didn’t, and help others avoid the same mistakes. Whether it’s inside your own company or with the wider community, that sharing is what makes you a go-to person others trust. In my view, that’s how you move from just being a practitioner to being a champion. Looking Forward Q: What feature are you most excited about in the roadmap? A: The feature I’m most excited about is the new ability to take actions directly from Advanced Hunting, submitting messages, adding to the Tenant Allow/Block List, and even triggering AIR investigations. For me, submissions and hunting are key parts of getting the most out of MDO, so bringing those actions together in one place will make it much easier to close the loop between detection and response. It’s a real step toward making MDO not just a filter, but an integrated part of SecOps workflows. Link: Microsoft 365 Roadmap | Microsoft 365 Q: One piece of feedback to influence MDO’s future? A: One piece of feedback I would give is around quarantine policies in Preset Security Policies. Today, if you use presets, you’re locked into Microsoft’s default quarantine settings and can’t attach your own custom quarantine policies. I would like to see more flexibility here, so that organizations can still benefit from the simplicity and strength of presets, but adjust the quarantine experience to fit their own needs. Q: Where do you see the biggest opportunities for Champs like you? A: The biggest opportunity for Champs is to be a bridge – sharing real-world lessons with the community and feedback with Microsoft. In the end, it’s about turning experience into progress for everyone.Hacking Made Easy, Patching Made Optional: A Modern Cyber Tragedy
In today’s cyber threat landscape, the tools and techniques required to compromise enterprise environments are no longer confined to highly skilled adversaries or state-sponsored actors. While artificial intelligence is increasingly being used to enhance the sophistication of attacks, the majority of breaches still rely on simple, publicly accessible tools and well-established social engineering tactics. Another major issue is the persistent failure of enterprises to patch common vulnerabilities in a timely manner—despite the availability of fixes and public warnings. This negligence continues to be a key enabler of large-scale breaches, as demonstrated in several recent incidents. The Rise of AI-Enhanced Attacks Attackers are now leveraging AI to increase the credibility and effectiveness of their campaigns. One notable example is the use of deepfake technology—synthetic media generated using AI—to impersonate individuals in video or voice calls. North Korean threat actors, for instance, have been observed using deepfake videos and AI-generated personas to conduct fraudulent job interviews with HR departments at Western technology companies. These scams are designed to gain insider access to corporate systems or to exfiltrate sensitive intellectual property under the guise of legitimate employment. Social Engineering: Still the Most Effective Entry Point And yet, many recent breaches have begun with classic social engineering techniques. In the cases of Coinbase and Marks & Spencer, attackers impersonated employees through phishing or fraudulent communications. Once they had gathered sufficient personal information, they contacted support desks or mobile carriers, convincingly posing as the victims to request password resets or SIM swaps. This impersonation enabled attackers to bypass authentication controls and gain initial access to sensitive systems, which they then leveraged to escalate privileges and move laterally within the network. Threat groups such as Scattered Spider have demonstrated mastery of these techniques, often combining phishing with SIM swap attacks and MFA bypass to infiltrate telecom and cloud infrastructure. Similarly, Solt Thypoon (formerly DEV-0343), linked to North Korean operations, has used AI-generated personas and deepfake content to conduct fraudulent job interviews—gaining insider access under the guise of legitimate employment. These examples underscore the evolving sophistication of social engineering and the need for robust identity verification protocols. Built for Defense, Used for Breach Despite the emergence of AI-driven threats, many of the most successful attacks continue to rely on simple, freely available tools that require minimal technical expertise. These tools are widely used by security professionals for legitimate purposes such as penetration testing, red teaming, and vulnerability assessments. However, they are also routinely abused by attackers to compromise systems Case studies for tools like Nmap, Metasploit, Mimikatz, BloodHound, Cobalt Strike, etc. The dual-use nature of these tools underscores the importance of not only detecting their presence but also understanding the context in which they are being used. From CVE to Compromise While social engineering remains a common entry point, many breaches are ultimately enabled by known vulnerabilities that remain unpatched for extended periods. For example, the MOVEit Transfer vulnerability (CVE-2023-34362) was exploited by the Cl0p ransomware group to compromise hundreds of organizations, despite a patch being available. Similarly, the OpenMetadata vulnerability (CVE-2024-28255, CVE-2024-28847) allowed attackers to gain access to Kubernetes workloads and leverage them for cryptomining activity days after a fix had been issued. Advanced persistent threat groups such as APT29 (also known as Cozy Bear) have historically exploited unpatched systems to maintain long-term access and conduct stealthy operations. Their use of credential harvesting tools like Mimikatz and lateral movement frameworks such as Cobalt Strike highlights the critical importance of timely patch management—not just for ransomware defense, but also for countering nation-state actors. Recommendations To reduce the risk of enterprise breaches stemming from tool misuse, social engineering, and unpatched vulnerabilities, organizations should adopt the following practices: 1. Patch Promptly and Systematically Ensure that software updates and security patches are applied in a timely and consistent manner. This involves automating patch management processes to reduce human error and delay, while prioritizing vulnerabilities based on their exploitability and exposure. Microsoft Intune can be used to enforce update policies across devices, while Windows Autopatch simplifies the deployment of updates for Windows and Microsoft 365 applications. To identify and rank vulnerabilities, Microsoft Defender Vulnerability Management offers risk-based insights that help focus remediation efforts where they matter most. 2. Implement Multi-Factor Authentication (MFA) To mitigate credential-based attacks, MFA should be enforced across all user accounts. Conditional access policies should be configured to adapt authentication requirements based on contextual risk factors such as user behavior, device health, and location. Microsoft Entra Conditional Access allows for dynamic policy enforcement, while Microsoft Entra ID Protection identifies and responds to risky sign-ins. Organizations should also adopt phishing-resistant MFA methods, including FIDO2 security keys and certificate-based authentication, to further reduce exposure. 3. Identity Protection Access Reviews and Least Privilege Enforcement Conducting regular access reviews ensures that users retain only the permissions necessary for their roles. Applying least privilege principles and adopting Microsoft Zero Trust Architecture limits the potential for lateral movement in the event of a compromise. Microsoft Entra Access Reviews automates these processes, while Privileged Identity Management (PIM) provides just-in-time access and approval workflows for elevated roles. Just-in-Time Access and Risk-Based Controls Standing privileges should be minimized to reduce the attack surface. Risk-based conditional access policies can block high-risk sign-ins and enforce additional verification steps. Microsoft Entra ID Protection identifies risky behaviors and applies automated controls, while Conditional Access ensures access decisions are based on real-time risk assessments to block or challenge high-risk authentication attempts. Password Hygiene and Secure Authentication Promoting strong password practices and transitioning to passwordless authentication enhances security and user experience. Microsoft Authenticator supports multi-factor and passwordless sign-ins, while Windows Hello for Business enables biometric authentication using secure hardware-backed credentials. 4. Deploy SIEM and XDR for Detection and Response A robust detection and response capability is vital for identifying and mitigating threats across endpoints, identities, and cloud environments. Microsoft Sentinel serves as a cloud-native SIEM that aggregates and analyses security data, while Microsoft Defender XDR integrates signals from multiple sources to provide a unified view of threats and automate response actions. 5. Map and Harden Attack Paths Organizations should regularly assess their environments for attack paths such as privilege escalation and lateral movement. Tools like Microsoft Defender for Identity help uncover Lateral Movement Paths, while Microsoft Identity Threat Detection and Response (ITDR) integrates identity signals with threat intelligence to automate response. These capabilities are accessible via the Microsoft Defender portal, which includes an attack path analysis feature for prioritizing multicloud risks. 6. Stay Current with Threat Actor TTPs Monitor the evolving tactics, techniques, and procedures (TTPs) employed by sophisticated threat actors. Understanding these behaviours enables organizations to anticipate attacks and strengthen defenses proactively. Microsoft Defender Threat Intelligence provides detailed profiles of threat actors and maps their activities to the MITRE ATT&CK framework. Complementing this, Microsoft Sentinel allows security teams to hunt for these TTPs across enterprise telemetry and correlate signals to detect emerging threats. 7. Build Organizational Awareness Organizations should train staff to identify phishing, impersonation, and deepfake threats. Simulated attacks help improve response readiness and reduce human error. Use Attack Simulation Training, in Microsoft Defender for Office 365 to run realistic phishing scenarios and assess user vulnerability. Additionally, educate users about consent phishing, where attackers trick individuals into granting access to malicious apps. Conclusion The democratization of offensive security tooling, combined with the persistent failure to patch known vulnerabilities, has significantly lowered the barrier to entry for cyber attackers. Organizations must recognize that the tools used against them are often the same ones available to their own security teams. The key to resilience lies not in avoiding these tools, but in mastering them—using them to simulate attacks, identify weaknesses, and build a proactive defense. Cybersecurity is no longer a matter of if, but when. The question is: will you detect the attacker before they achieve their objective? Will you be able to stop them before reaching your most sensitive data? Additional read: Gartner Predicts 30% of Enterprises Will Consider Identity Verification and Authentication Solutions Unreliable in Isolation Due to AI-Generated Deepfakes by 2026 Cyber security breaches survey 2025 - GOV.UK Jasper Sleet: North Korean remote IT workers’ evolving tactics to infiltrate organizations | Microsoft Security Blog MOVEit Transfer vulnerability Solt Thypoon Scattered Spider SIM swaps Attackers exploiting new critical OpenMetadata vulnerabilities on Kubernetes clusters | Microsoft Security Blog Microsoft Defender Vulnerability Management - Microsoft Defender Vulnerability Management | Microsoft Learn Zero Trust Architecture | NIST tactics, techniques, and procedures (TTP) - Glossary | CSRC https://learn.microsoft.com/en-us/security/zero-trust/deploy/overview
Tenant Allow/Block Lists Versus Anti-spam List
Hello, I am an unsophisticated administrator for my account. So if I am posting this information in the wrong location, please forgive me and let me know where it should be posted. I have been getting inundated with financial spam or phishing emails. This spammer creates new domain names on a daily or weekly basis, and then sends new spam from these new domains. I typically get about thirty spam emails a day. And my guess is that, although they come from different domains, there is one organization behind all of them. Often, I get more than one email per domain per day. Fortunately, most of these emails end up in my junk folder. I want to stop these spammers from even reaching my Junk folder in Outlook. I want to keep them completely out of my email system. At first, I went to Microsoft 365 Defender > Email & collaboration > Policies & Rules > Threat policies and added their emails and domains to “Tenant Allow/Block Lists.” While that captured most of the known spam emails, one got through to my Junk folder. Being curious, I contacted Microsoft. I was told to add the spammers’ email addresses and domains to the “Anti-spam” list. I am not sure if this change will solve my concern. My question is as follows: What is the difference between these two lists? And why should I choose one over the other? My recommendations are as follows: For the Anti-spam list, it would be helpful to allow users to add more than one email address or domain name at a time. At present, it is painful manually adding many entries. For the Anti-spam list, it would be helpful to add the date each entry was added and allow for a comment section, similar to the Tenant Allow/Block list. It would be great if users or admins could right mouse click on a spam or phishing email in their Outlook programs and then have that email address or domain name blocked from reaching Outlook in the future. Because this affects the organization, perhaps it is best if this ability is restricted to administrators.Monthly news - August 2025
Microsoft Defender XDR Monthly news - August 2025 Edition This is our monthly "What's new" blog post, summarizing product updates and various new assets we released over the past month across our Defender products. In this edition, we are looking at all the goodness from July 2025. Defender for Cloud has it's own Monthly News post, have a look at their blog space. Microsoft Defender Microsoft Sentinel is moving to the Microsoft Defender portal to deliver a unified, AI-powered security operations experience. Many customers have already made the move. Learn how to plan your transition and take advantage of new capabilities in the this blog post. Introducing Microsoft Sentinel data lake. We announced a significant expansion of Microsoft Sentinel’s capabilities through the introduction of Sentinel data lake, now rolling out in public preview. Read this blog post for a look at some of Sentinel data lake’s core features. (Public Preview) The GraphApiAuditEvents table in advanced hunting is now available for preview. This table contains information about Microsoft Entra ID API requests made to Microsoft Graph API for resources in the tenant. (Public Preview) The DisruptionAndResponseEvents table, now available in advanced hunting, contains information about automatic attack disruption events in Microsoft Defender XDR. These events include both block and policy application events related to triggered attack disruption policies, and automatic actions that were taken across related workloads. Increase your visibility and awareness of active, complex attacks disrupted by attack disruption to understand the attacks' scope, context, impact, and actions taken. Introducing Summary Rules Templates: Streamlining Data Aggregation in Microsoft Sentinel. Microsoft Sentinel’s new Summary Rules Templates offer a structured and efficient approach to aggregating verbose data - enabling security teams to extract meaningful insights while optimizing resource usage. Automating Microsoft Sentinel: Playbook Fundamentals. This is the third entry of the blog series on automating Microsoft Sentinel. In this post, we’re going to start talking about Playbooks which can be used for automating just about anything. Customer success story: Kuwait Credit Bank boosts threat detection and response with Microsoft Defender. To modernize its security posture, the bank unified its security operations under Microsoft Defender XDR, integrating Microsoft Sentinel and Microsoft Purview. Microsoft Defender for Cloud Apps App Governance is now also available in Brazil, Sweden, Norway, Switzerland, South Africa, South Korea, Arab Emirates and Asia Pacific. For more details, see our documentation.. Updated network requirements for GCC and Gov customers. To support ongoing security enhancements and maintain service availability, Defender for Cloud Apps now requires updated firewall configurations for customers in GCC and Gov environments. To avoid service disruption, take action by August 25, 2025, and update your firewall configuration as described here. Discover and govern ChatGPT and other AI apps accessing Microsoft 365 with Defender for Cloud Apps. In this blog post, we’ll explore how Defender for Cloud Apps helps security teams gain enhanced visibility into the permissions granted to AI applications like ChatGPT as they access Microsoft 365 data. We’ll also share best practices for app governance to help security teams make informed decisions and take proactive steps to enable secure usage of AI apps accessing Microsoft 365 data. Microsoft Defender for Endpoint (General Availability) Microsoft Defender Core service is now generally available on Windows Server 2019 or later which helps with the stability and performance of Microsoft Defender Antivirus. Microsoft Defender for Identity Expanded coverage in ITDR deployment health widget. With this update, the widget also includes deployment status for ADFS, ADCS, and Entra Connect servers - making it easier to track and ensure full sensor coverage across all supported identity infrastructure. Time limit added to Recommended test mode. Recommended test mode configuration on the Adjust alert thresholds page, now requires you to set an expiration time (up to 60 days) when enabling it. The end time is shown next to the toggle while test mode is active. For customers who already had Recommended test mode enabled, a 60-day expiration was automatically applied. Identity scoping is now available in Governance environments. Organizations can now define and refine the scope of Defender for Identity monitoring and gain granular control over which entities and resources are included in security analysis. For more information, see Configure scoped access for Microsoft Defender for Identity. New security posture assessments for unmonitored identity servers. Defender for Identity has three new security posture assessments that detect when Microsoft Entra Connect, Active Directory Federation Services (ADFS), or Active Directory Certificate Services (ADCS) servers are present in your environment but aren't monitored. Learn more in our documentation. Microsoft Defender for Office 365 Protection against multi-modal attacks with Microsoft Defender. This blog post showcases how Microsoft Defender can detect and correlate certain hybrid, multi-modal attacks that span across email, Teams, identity, and endpoint vectors; and how these insights surface in the Microsoft Defender portal. Users can report external and intra-org Microsoft Teams messages from chats, standard and private channels, meeting conversations to Microsoft, the specified reporting mailbox, or both via user reported settings. Microsoft Security Blogs Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats. Microsoft Threat Intelligence has uncovered a cyberespionage campaign by the Russian state actor we track as Secret Blizzard that has been ongoing since at least 2024, targeting embassies in Moscow using an adversary-in-the-middle (AiTM) position to deploy their custom ApolloShadow malware. Sploitlight: Analyzing a Spotlight-based macOS TCC vulnerability. Microsoft Threat Intelligence has discovered a macOS vulnerability, tracked as CVE-2025-31199, that could allow attackers to steal private data of files normally protected by Transparency, Consent, and Control (TCC), including the ability to extract and leak sensitive information cached by Apple Intelligence. Disrupting active exploitation of on-premises SharePoint vulnerabilities. Microsoft has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon, exploiting vulnerabilities targeting internet-facing SharePoint servers.
Quarantine "finger print matching" false positive
Just done my regular quarantine check on our O365 tenant and was surprised to find a couple of legit messages from an external sender which were flagged as High Confidence Phish based on finger print matching, which I understand translates to a close match to a previously detected malicious message. I can see absolutely nothing wrong with the message and it was so very business specific in its content that I cannot see that it would closely match anything else that had ever gone before. The recipient tells me they regularly exchange business emails with the sender without any issue. When I run off a report and look at other recent messages caught by finger print matching on my tenant, they were the usual phishing emails that are probably doing the rounds globally and were correctly trapped. Questions are: 1. Anyone know why something so highly specific in its content would be trapped in this way? 2. I feel I can't trust O365 to correctly quarantine based on this example, but High Confidence Phish is currently set to have the AdminOnlyAccessPolicy applied on my tenant - and this doesn't notify. Is there any way for a sys admin (only) to be notified by email when something goes into quarantine? I can set up a custom policy to allow RECIPIENT notification but I don't really want to involve them when messages are being correctly quarantined almost all of the time. Ours is a non-profit tenant so I can't be sitting around watching it all day - I need it to tell me when something has happened! Thanks for any ideas!
How to Connect MS Secure Scores to Power Query?
The Microsoft 365 Defender Portal (https://security.microsoft.com/) has a 'Secure Score' page, which contains the following: An overall secure score which is then broken down by Identity, Data, Device, and Application secure scores. I would like to be able to pull these four scores into a Power BI report; however, I have had some difficulty in putting together a solution. This data seems like it could be found in the Microsoft Graph API, but https://learn.microsoft.com/en-us/power-query/connecting-to-graph. I've tried other Defender APIs, but they all seem either outdated or out of scope for what I'm trying to pull. Can anyone advise? Thanks for reading.Best Practices for Investigating Phishing Incidents in Microsoft Defender for Office 365
Discover best practices for investigating phishing incidents with Microsoft Defender for Office 365. Learn how to use the Incidents tab, analyze threats, and accelerate response with Security Copilot’s AI-powered guidance.
Secure Score isn't loading
Hi! For more than a week, the Microsoft Secure Score isn't displaying my organisation's score or any actions to review or recommended ones. I'm having problems with Teams' access lately and I need to check the security configurations as soon as possible. Does anyone have the same issue?Monthly news - June 2025
Microsoft Defender XDR Monthly news - June 2025 Edition This is our monthly "What's new" blog post, summarizing product updates and various new assets we released over the past month across our Defender products. In this edition, we are looking at all the goodness from May 2025. Defender for Cloud has it's own Monthly News post, have a look at their blog space. Unified Security Operations Platform: Microsoft Defender XDR & Microsoft Sentinel From on-premises to cloud: Graph-powered detection of hybrid attacks with Microsoft exposure graph. In this blog, we explain how the exposure graph, an integral part of our pre-breach security exposure solution, supercharges our post-breach threat protection capabilities to detect and respond to such multi-faceted threats. (Public Preview) Unified detections rules list that includes both analytics rules and custom detections is in public preview. Learn more in our docs. The Best of Microsoft Sentinel — Now in Microsoft Defender. We are proud to share that the most advanced and integrated SIEM experience from Microsoft Sentinel is now fully available within the Microsoft Defender portal as one unified experience. (General Available) Multi workspace for single and multi tenant is now in General Available. (Public Preview) Case management now available for the Defender multitenant portal. For more information, see View and manage cases across multiple tenants in the Microsoft Defender multitenant portal. (Public Preview) You can now highlight your security operations achievements and the impact of Microsoft Defender using the unified security summary. For more information, see Visualize security impact with the unified security summary. (Public Preview) New Microsoft Teams table: The MessageEvents table contains details about messages sent and received within your organization at the time of delivery (Public Preview) New Microsoft Teams table: The MessagePostDeliveryEvents table contains information about security events that occurred after the delivery of a Microsoft Teams message in your organization (Public Preview) New Microsoft Teams table: The MessageUrlInfo table contains information about URLs sent through Microsoft Teams messages in your organization Unified IdentityInfo table in advanced hunting now includes the largest possible set of fields common to both Defender and Azure portals. Microsoft Defender for Endpoint (Webinar - YouTube Link) Secure Your Servers with Microsoft's Server Protection Solution- This webinar offers an in-depth exploration of Microsoft Defender for Endpoint on Linux. Defender for Endpoint successfully passes the AV-Comparatives 2025 Anti-Tampering Test. Discover how automatic attack disruption protects critical assets while ensuring business continuity. Microsoft Defender for Office 365 Part 2: Build custom email security reports and dashboards with workbooks in Microsoft Sentinel New deployment guide: Quickly configure Microsoft Teams protection in Defender for Office 365 Plan 2 New SecOps guide: Security Operations Guide for Teams protection in Defender for Office 365 Video - Ninja Show: Advanced Threat Detection with Defender XDR Community Queries Video- Mastering Microsoft Defender for Office 365: Configuration Best Practices Video - Ninja Show: Protecting Microsoft Teams with Defender for Office 365 This blog discussed the new Defender for Office 365 Language AI for Phish Model. SafeLinks Protection for Links Generated by M365 Copilot Chat and Office Apps. Microsoft Defender for Cloud Apps New Applications inventory page now available in Defender XDR. The new Applications page in Microsoft Defender XDR provides a unified inventory of all SaaS and connected OAuth applications across your environment. For more information, see Application inventory overview. The Cloud app catalog page has been revamped to meet security standards. The new design includes improved navigation, making it easier for you to discover and manage your cloud applications. Note: As part of our ongoing convergence process across Defender workloads, Defender for Cloud Apps SIEM agents will be deprecated starting November 2025. Learn more. Microsoft Defender for Identity (Public Preview) Expanded New Sensor Deployment Support for Domain Controllers. Learn more. Active Directory Service Accounts Discovery Dashboard. Learn more. Improved Visibility into Defender for Identity New Sensor Eligibility in the Activation page. The Activation Page now displays all servers from your device inventory, including those not currently eligible for the new Defender for Identity sensor. Note: Local administrators collection (using SAM-R queries) feature will be disabled. Microsoft Security Blogs Analyzing CVE-2025-31191: A macOS security-scoped bookmarks-based sandbox escape Marbled Dust leverages zero-day in Output Messenger for regional espionage Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer New Russia-affiliated actor Void Blizzard targets critical sectors for espionage Defending against evolving identity attack techniques Threat Analytics (Access to the Defender Portal needed) Activity profile - AITM campaign with brand impersonated OAUTH applications Threat overview: SharePoint Server and Exchange Server threats Vulnerability profile: CVE-2025-24813 – Apache Tomcat Path Equivalence Vulnerability Actor profile: Storm-0593 [TA update] Actor profile: Storm-0287 Activity Profile: Marbled Dust leverages zero-day to conduct regional espionage [TA update] Technique profile: ClickFix technique leverages clipboard to run malicious commands Technique profile: LNK file UI feature abuse Technique profile: Azure Blob Storage threats Activity profile: Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer Vulnerability profile - CVE-2025-30397 Activity profile: Recent OSINT trends in information stealers
