Empowering Admins with Insights
The Office 365 Security and Compliance Center already provides access to malware trends, real-time reports, and granular threat details. Microsoft is now adding organizational insights such as anomalous behavior or repeat policy offenders. These insights are presented both in the reports and in the threat dashboard, correlating signals from a broad range of data to help identify, prioritize, and provide recommendations on how to address potential problems. The recommendations are generally remediation actions empowering admins to proactively secure their organization. The insights are holistic and cover both information and threat protection.
Threat Protection Insights include:
- Policy or end user configurations (e.g. transport or mail flow rules, custom policy settings, junk mail folder settings) that can be improved to block delivery of malware, phish, or spam.
- Policies and configurations enhancing protection for users targeted by malware and phishing campaigns in an organization.
Soon Microsoft will release an enhanced Threat Protection status trending report, offering a single view with drill downs into malicious emails identified within the organization, including detection details for malware and phish.
Information Protection Insights include:
- Views into users who violate large volumes of Office 365 Data Loss Prevention (DLP) policies
- Anomaly insights showing unusual trends in your DLP policy violations
Microsoft is also introducing a new report of DLP policy matches on a per item level enabling easier identification of documents or emails which violate policies.
Enhanced Admin Quarantine
Admins can now view, release, delete, and report false positive quarantined messages in Office 365. Quarantine for the Office 365 Security and Compliance Center (SCC) is enriched with a more in-depth investigation and analysis experience including:
- Enhanced search and filtering capabilities for messages in quarantine.
- In line actions for message download and release to any recipient, supporting security investigation and analysis workflows in the organization.
- Extending retention of quarantined messages to 30 days which can be updated via the anti-spam policy settings in SCC.
- Restricting the ability to view, download, release, delete, and report phishing messages in quarantine to admins (due to rise in phishing campaigns)
Microsoft recently announced the extension of Office 365 Advanced Threat Protection (ATP) to protect files in SharePoint Online, OneDrive for Busi... and they’re excited to now extend quarantine capabilities to files stored in these applications. This includes download, release, report and delete features in quarantine.
- ‘Release’ removes the end user block on the file
- ‘Delete’ removes the file from quarantine; however, the file is still blocked in SharePoint Online, OneDrive for Business and Microsoft Teams and must be deleted from the respective document libraries in these services to preserve content specific audited activities
Now admins can create policies to send filtered messages to quarantine when they were identified as spam, bulk, phish, or when they match a mail flow rule. By default, Office 365 sends phishing messages and messages containing malware directly to quarantine. Other filtered messages are sent to users' Junk Email folder unless the policy specifies sending them to quarantine.