Recent DiscussionsMost RecentNewest TopicsMost LikesSolutionsTagged:TagRe: AIR Result : Email template modificationWe have this on the backlog but the probability of getting to this calendar year is very less.Re: User reported messages data tableYou have to join the concept of outer join where the outer data is all user report and inner data is user report which has been marked and notified.Re: User reported messages data table dmarquesgnCheck out submission id or message reported id Re: User reported messages data table dmarquesgn The table inside Advanced hunting with submission events is CloudAppEvents. The events are denoted as ActionType and the specific action are "SubmissionAdminReview" and "UserSubmission" "UserSubmission" action is triggered whenever user report is done. "SubmissionAdminReview" action is triggered whenever admin reviews the user report. a sample query is CloudAppEvents | where ActionType == "SubmissionAdminReview" | take 100 Re: Submission and notification for 3rd Party Phishing Simulations vpatil99the mark and notify feature is designed to provide feedback on messages reported from the wild. For the phish simulation one, you need to configure follow up notifications for your end users from the native phish simulation tool. Re: Submission and notification for 3rd Party Phishing Simulationsvpatil99 have you not setup notification from the attack simulation tool or the 3rd party phishing simulation tool you are using? Is there a reason why you want to notify the end users from here?Re: Report message add-in and Shared MailboxesThe inbuild button has landed for Outlook for web. Work is ongoing to release it across outlook for windows, mobile and Mac as soon as possibleRe: Report message add-in and Shared MailboxesAs you might be aware that we are implementing inbuild buttons for reporting across different outlook clients. Outlook for web client this has landed with the support for shared and delegate mailbox reporting. Win32, Mobile and Mac outlook clients will add the support for inbuild button along with shared and delegate mailbox reporting. The add-ins wont get this support. Please use the inbuild buttonsRe: Report message add-in and Shared Mailboxeshttps://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/submissions-outlook-report-messages?view=o365-worldwide#use-the-built-in-report-button-in-outlook-on-the-web Check this section - shared and delegate mailboxes are supported on Outlook for web. There is work ongoing to add support for other outlook clientsRe: Report Message Add-in going away? JonasBackthere is no update on the ETA for outlook Windows clients, Outlook Mobile client and Outlook Mac client. To make the transition smoother, the report phish and report message add-in and the inbuild report button are both supported by Microsoft. Irrespective of wherever the end user report from, it will be routed as per your user reported settings. Hope that helps. Re: User Submission - Pending Gunter DanzeisenThanks for sending this across we will look into this Re: User Submission - Pending Gunter Danzeisenthis seems like a bug as if user reports are going to custom mailbox so should not be analyzed by Microsoft then. Could I have the network message id so that we can look into it and correct it? Re: Report Message Add-in going away?No, the timelines have changed and we dont have an updated ETA as of now. We have not rolled it out anywhere till now. There will be prior communication before it is rolled out anywhereRe: Report Message Add-in going away?There is no ETA on it and blog post and MC post around it. Still, you have my assurance that those will be done before it is rolled out.Re: Report message add-in and Shared MailboxesToday the add-in does not read from the shared/delegate mailboxes. So not a supported scenario. We are working to address this when we roll out the outlook inbuild buttons for reporting stuff across all our outlook clients (OWA, desktop, mobile, MAC). There is no ETA for this now and there is no blog post and MC post around it.Re: Report Message Add-in going away?We will be supporting the add-in till your organization is comfortable using the outlook buttons we will be rolling out in few months. We will be publishing a blog and MC post detailing more about the changes soon. We want to ensure a smooth transition for everyoneRe: Report Message Add-in going away? Marco Bunschoten the report message add-in and phishing is eventually going to go away (once your organization has moved over to reporting from outlook buttons and we will provide you ample time for the same). Till that happens, the users can report phishing from the add-in. Re: Submission and notification for 3rd Party Phishing SimulationsDont worry we have an upcoming change from Microsoft Defender for Office 365 which should help streamline this for you. There is no ETA for that. also we cannot share anything more than this at the moment
Recent Blog ArticlesMost RecentMost LikesRe: How your submissions to Defender for Office 365 are processed behind-the-scenes PeterForsterI understand your concern but since attackers keep coming up with a lot of novel attack techniques, it is hard to even tell at times if it is a known bad actor without the sender/recipie...Re: How your submissions to Defender for Office 365 are processed behind-the-scenes PeterForsterWhile the majority of Microsoft's enterprise online services in the Azure, Dynamics 365, Power Platform, and Microsoft 365 service families are in-scope for the EU Data Boundary, subjec...How your submissions to Defender for Office 365 are processed behind-the-scenes Get an overview of what happens behind-the-scenes when you submit suspicious items for analysis in Defender for Office 365 Re: Extend allow in Tenant Allow/Block List allow entries in a transparent data driven manner LewisBarryMVPI did not follow the question. Could you please rephrase it? Re: Introducing tenant blocks via admin submissions Good question. URL and file blocks send email containing them to admin quarantine. Sender (or domains & addresses) does not do it which we plan to address soon so that there is parity and visibilit...Re: Introducing tenant blocks via admin submissions Yes, this is also possible when you turn a user submission into admin submission. Introducing tenant blocks via admin submissions Announcing the ability to create tenant blocks via the admin submissions flyout in the Defender portal. Re: Unified submissions in Microsoft 365 Defender now Generally Available! JonasBack 1. Microsoft Defender for Office 365 is working on this. In the future you can leverage review section of quarantine to take actions on file quarantined. Some pieces of it already ex...Re: Mastering Configuration in Defender for Office 365 - Part Three It is intended to provide baseline protection for paid tenants who have not complete configuration in the same way that default policies do for anti-malware, anti-phish, etc... The feature was implem...Re: Streamlining the submissions experience in Microsoft Defender for Office 365 Thanks for bringing this to our attention. We are going to address this promptly.
MicrosoftMicrosoftMicrosoftMicrosoft
