Category: MDO

As part of ongoing improvements to bulk email filtering in Microsoft Defender for Office | Exchange Online Protection, Microsoft is refining our detection capabilities by recalibrating and redistributing bulk senders across different bulk complaint levels (BCL). This would automatically make the current bulk thresholds slightly more aggressive. As a consequence, Microsoft is updating bulk threshold for standard …

Bulk emails play a crucial role in modern enterprise communications. Determining the right balance of these messages—what should be allowed and what should be blocked—poses a significant challenge. Many organizations default to standard settings, often leading to issues like false positives (FP) and false negatives (FN) in email. With Bulk Senders Insight in Microsoft Exchange Online Protection …

Microsoft Defender for Office 365 is retiring four legacy override alerts that are now mostly redundant due to Secure by default. With Secure by default, ZAP (zero-hour auto purge) blocks high confidence phishing emails by default despite the legacy overrides. The four alerts are: As part of the deprecation and rollout, When is the change? Microsoft plan to …

Microsoft is introducing password protected downloads of email messages from the Email Entity Summary Panel in Microsoft Defender for Office 365. Today, password protected downloads are available from the Quarantine experience.  When this will happen: General Availability: Microsoft will begin rolling out mid-March 2024 and expect to complete by late March 2024. How this will …

In Microsoft Defender for Office 365, Microsoft is rolling out new details on who or what is responsible for releasing a message from quarantine. These details will now be included in the email summary flyout panel accessible from the Quarantine page. When this will happen: General Availability : Microsoft will begin rolling out late March …

In Microsoft Defender for Office 365, Microsoft is updating the way end users allow and block emails in Exchange Online.  When this will happen: Microsoft will begin rolling out late April 2024 and expect to complete by mid-May 2024. How this will affect your organization: With one click, end users will block emails from unwanted …

Quarantine End User Allow and Block list management, sign in to the security portal will be required for the Block Sender action in Quarantine notifications.  When this will happen: Microsoft will begin rolling out early March 2024 and expect to complete by mid-March 2024. How this will affect your organization: When the user clicks on …

The ability for Microsoft Teams users to report internalchats, channels and meeting conversations within Teams as a security risk will be turned ON by default. Security risk messages could include ones that contain phishing or spam or malicious content, such as phishing URL or malware file, spam content. To learn how end users can report, …

Microsoft will be updating the way intra-organizational SCL ratings are assigned for intra-organizational messages. When this will happen: Changes to logging intra-organizational messages will begin rolling out in early April and is expected to be complete by late June. How this will affect your organization: All intra-organizational messages are currently marked with SCL -1 (bypass …

Attack Simulation Training is an intelligent phish risk reduction tool that measures behavior change and automates deployment of an integrated security awareness training program across an organization. It is available with Microsoft 365 E5 or Microsoft Defender for Office 365 P2 plan. As per the previous experience, users were directed to the Microsoft curated credential harvest login …

Given feedback from customer on the need for an additional time to triage the emails or files that were quarantined as result of potential malware, Microsoft is increasing the retention period from 15 days to 30 days. When this will happen Standard Release: will begin rolling this out by end of July and expect to …

With the deployment of the Tenant Allow/Block List, as being the single source of truth for Tenant Allows, other mechanisms for Tenant Allows are being removed. This will give SecOps teams one place to manage all Tenant Allows. Today, “DoNotRewrite” list is used to Skip wrapping URLs Detonation(SONAR) Verdicts. The intended purpose of “DoNotRewrite” is …

With this change Microsoft is giving the ability to password protects items they download from quarantine. Microsoft wants users to be confident that the items they are downloading to their systems will not execute involuntarily without their consent, and this capability will allow them to safely transport the items to external analysis tools. When this …

Microsoft will be adding capabilities to making it possible for Security Operations (SecOps) to customize end user quarantine notifications with their respective organization sender address and custom subject. When this will happen: Standard: will begin rolling out in late August and is expected to be complete by early September. Government: will begin rolling out in …

The April 13, Microsoft announced general availability of differentiated protection for priority accounts, people like executives, leaders, managers, or other users who have access to sensitive, proprietary, or high priority information. With this release, users tagged as priority accounts will receive a higher level of protection against threats. Licences The Priority account protection feature is …

Get-AdvancedThreatProtectionDocumentReport and Get-AdvancedThreatProtectionDocumentDetail will be retired Microsoft will be retiring the Get-AdvancedThreatProtectionDocumentReport and Get-AdvancedThreatProtectionDocumentDetail cmdlet from Microsoft Defender for Office 365. Instead, Microsoft recommends the use of the Get-ContentMalwareMdoAggregateReport | Get-ContentMalwareMdoDetailReport cmdlet. Key points Timing: retirement will begin in early May and is expected to complete by mid-May Action: review and transition to the Get-ContentMalwareMdoAggregateReport …

Microsoft is improving Automated Investigation and Response (AIR) from Defender for Office365 The rollout of the updated email clustering will begin today, June 21st. Investigations will now only queue actions for approval when malicious emails are still in the mailbox (by using latest delivery location instead of original). Investigations only queue actions for malware or …

Microsoft is introducing a new capability, Advanced Delivery, for the configuration of third-party phishing simulation campaigns and delivery of messages to security operations (SecOps) mailboxes. Admins will now be able to explicitly configure for the following scenarios and ensure messages configured as part of these scenarios are handled correctly across product experiences: Third-Party Phish simulation …