MDO – Microsoft Defender for Office 365
A common issue when deploying Exchange Online Protection (EOP) and Microsoft Defender for Office 365 (MDO) with on-premises Exchange is making Exchange aware of the EOP spam filtering. This is because EOP uses slightly different logic to stamp the spam results etc. into the message. Exchange Server needs to be aware of this so that it can take action upon those settings.
Note that there have been changes to Safe Links policy for Microsoft Defender for Office 365 (MDO).
Previously you could add URLs to the Safe Links policy to control how MDO would process the URLs. As part of this change the URL blocking is moving to the Tenant Allow Block List (TABL).
Below is a screenshot showing that a previously entered URL needs to be migrated to TABL.
&nb… Read the rest “Migrate Safe Links Block Settings to TABL”
Below are a series of links to the main Microsoft Defender for Office 365 blog. Shortcuts added here as this is one of my shared bookmarks.
Note that some links have KQL queries and IOCs related to that specific attack.
12-July-2022