XDR advanced hunting region specific endpoints
Hi, I am exploring XDR advanced hunting API to fetch data specific to Microsoft Defender for Endpoint tenants. The official documentation (https://learn.microsoft.com/en-us/defender-xdr/api-advanced-hunting) mentions to switch to Microsoft Graph advanced hunting API. I had below questions related to it: 1. To fetch the region specific(US , China, Global) token and Microsoft Graph service root endpoints(https://learn.microsoft.com/en-us/graph/deployments#app-registration-and-token-service-root-endpoints ) , is the recommended way to fetch the OpenID configuration document (https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc#fetch-the-openid-configuration-document) for a tenant ID and based on the response, the region specific SERVICE/TOKEN endpoints could be fetched? Since using it, there is no need to maintain different end points for tenants in different regions. And do we use the global service URL https://login.microsoftonline.com to fetch OpenID config document for a tenantID in any region? 2. As per the documentation, Microsoft Graph Advanced hunting API is not supported in China region (https://learn.microsoft.com/en-us/graph/api/security-security-runhuntingquery?view=graph-rest-1.0&tabs=http). In this case, is it recommended to use Microsoft XDR Advanced hunting APIs(https://learn.microsoft.com/en-us/defender-xdr/api-advanced-hunting) to support all region tenants(China, US, Global)?
Secure score not improving after implementing ASR
I need some help on the following; Improving secure score for one of our customers. For example, the secure score is improving for identity. I implemented user risk and sign in risk CA policies on the 14th and on the 18th defender is increasing the secure score However i also implemented ASR rules 23rd of september but it still says ASR are recommended actions. Etcetera. I powershelled into one of the targeted endpoints and confirmed the ASR rules are active on the machine. Connector is on The are using Crowdstrike as primary AV. Can the 2 AVs work together so the score gets updated for device? Would i need to manually create exeptions for every rule? I hope not.. Thank you in advance. Regards, Andrew
User Reported Spam/Phishing Messages Not Showing in Submission Portal
This happens every so often, where users using the report message option in Outlook don't have their submissions ever show up on the User Reported Tab in the Submissions Portal. (or often time there are large delays of an hour or more before messages will show up). I have the report message button set to copy an internal mailbox as well, and I see submissions go there. I see in the message trace logs, messages are being sent to the equivalent office365.microsoft.com address (email address removed for privacy reasons for example). Last time I opened a case for this, and it was a very frustrating experience because we only have standard support, so they never would really look into the issue to far. Well, it's happening again since yesterday afternoon, and while it's not a total security issue, it's annoying because our end users have come to expect the responses on their submission, and it's easier to submit these to Microsoft if they show up in the submission portal than having to manually upload them from the internal mailbox these get sent to as well. No service health issues posted in our tenant, but last time we had this support said they don't post issues for things like this typically even if it's a known service side issue processing these. I don't know if that's true or not. Anyone else seeing this issue?
User reported messages data table
Hi, I'm using the "Submissions" page on Defender to reply (with custom messages) to our users who report some email as phishing. On the portal, I can see if the report has been already replied or not on the field "Marked as", which has the value "Doesn't apply" whenever no one replied yet. I want to extract some metrics daily to check if all reported messages have had a reply for example. But I don't know where can I get this data from. Do you know in which table I can find this data to create some hunting queries? Thanks
Feedback: Email Quarantine UI needs improvement re: reporting sender as safe/unsafe
This is feedback for Microsoft 365 Defender (part of my organization's Office 365). I can't use the Feedback link within the site (security.[tenant info]/homepage) because of my organization's network security settings. When Outlook tells me I have emails in Quarantine and I'm sent to the site, the UI just has options focused on releasing or deleting the quarantined emails. The algorithm often blocks legitimate emails and I want to provide feedback to the algorithm so it will improve, but since I'm rarely on the site I waste time looking for ways to report an email safe/unsafe. I clearly have to do this reporting before* releasing/deleting an email because then the email will no longer be in the quarantine system to reference. However, once I give up looking, select all the legit emails and then click release - only then is there a pop-up sidebar which includes a "Report message as having no threats" checkbox as a final step of the release process. This is counterintuitive (reference * above). When looking at the Review > Quarantine window, before choosing an action there should be clear UI options for "mark safe and release" and "report and delete".
Strengthen your Security with the New Reporting Suspicious Messages feature in Microsoft Defender
Yay! The long wait is over! Recently, Microsoft announced the enhancements in reporting message feature in Outlook Web App. Now, Microsoft 365 users can report messages from any Exchange Online mailbox, irrespective of their type. This is absolutely great and it helps security admins and cybersecurity experts to defend against crucial phishing and spoofing attacks. Check out the blog below to know more about the new enhancements and how it works. https://blog.admindroid.com/reporting-suspicious-messages-in-m365-shared-and-delegated-mailboxes/
Microsoft Defender is Illegally Blocking Legitimate Business EMail Across all 365 Tenants as "BULK"
We have identified that Microsoft started classifying "BULK" emails as spam back in January 2022. However this is now also blocking legitimate emails sent from (1) sender to (1) recipient with the email still labeled as "BULK". I have multiple tickets opened with various departments. I was told today by MS Support this is a known issue, but they are waiting for engineering to provide a fix. You can fit it by reverting back and then implementing the solution correctly later on. At the end of the day, MS started changing the behavior of the default anti-spam policy in such a way that is blocking legitimate email that is not being sent in bulk. Legally I believe what Microsoft is doing here is known as a "Restraint of Trade". These are not emails sent to me. These are email's I am sending to my customers and potential customers. These are also emails that my customers are sending to their customers. Microsoft's change regarding "Bulk Email" is not applying to actual bulk messages sent to more than X number of recipients. Microsoft is now blacklisting individuals who have ever sent an email in "bulk" and all future emails, even if sent to a single recipient is still classified as "bulk". The default anti-spam policy configured automatically for all Office365 customers is now using the logic listed above. So, the recipients have not made any modification to cause this change, Microsoft is imposing this change on all their customers using the default anti-spam policy tenant by tenant. The majority of Office365 customers are small business with no real IT support or knowledge of these settings. They licensed the product and are conducting business. Microsoft's change to the handling of "Bulk" email that started back in January 2022 is creating this issue and is now basically in violation potentially of service agreements from paying customers. I pay MS to be able to send an email from me to my potential customer. MS default anti-spam policy now states that if I have ever sent email in "BULK" all of my emails are flagged in "BULK" and are defaulted to the user's quarantine.
