Mac Resources
Email and collaboration
The page author metadata changed from paulinbar/painbar to limwainstein. The uninstall guidance continues to direct administrators to the Offboard Mac devices documentation for cleanup requirements.
Cross-product topic
Email and collaboration
A cross-product view of Microsoft Defender changes related to Email and collaboration.
Latest Email and collaboration changes
Submissions Admin Review User Reported Messages
Email and collaboration
The documentation now lists the languages supported by localized default notification templates, including English, Japanese, Spanish, Chinese, Korean, Portuguese, and others.
Anti Spam Bulk Complaint Level Bcl About
Email and collaboration
The documentation now says the features, including SOC experiences, should be available in all organizations by the end of October instead of mid-September.
Anti Spam Bulk Complaint Level Bcl About
Email and collaboration
The page now explains that `X-MS-Exchange-Organization-BulkStamping` is used only during message transport and removed before delivery to the mailbox, so recipients cannot see it in message headers.
Defender For Office 365 Whats New
Email and collaboration
The EmailPostDeliveryEvents table documentation now includes the ApproverUpn field, which identifies the approving user or administrator.
Safe Links About
Email and collaboration
The Safe Links documentation date was updated, and its explanation of URL scanning before delivery, at click time, and through the client-side API was revised.
Air About
Email and collaboration
The documentation now explains how to select a built-in rule on the Alert tuning page and disable it from the rule details pane, with a screenshot.
Attack Simulation Training Faq
Email and collaboration
The FAQ now explains that security tools can generate click telemetry during content inspection, recommends built-in simulation reports, and notes that Safe Links and UrlClickEvents may not capture all simulation activity.
Attack Simulation Training Insights
Email and collaboration
The documentation now refers to automated inspection of the simulation payload in the Clicked Message Link entry, replacing wording about non-Microsoft filtering services.
Anti Spam Bulk Complaint Level Bcl About
Email and collaboration
As of July 2026, messages identified as bulk receive the Promotions tag and, when Bulk moves enabled is turned on, are moved from the Inbox to the Promotions folder only when they are promotional in nature, regardless of BCL value.
Quarantine Admin Manage Messages Files
Email and collaboration
The instructions now state that the Source tab displays the message body as HTML with links disabled. The separate Plain text tab description was removed, and the metadata date was updated.
Defender For Office 365 Whats New
Email and collaboration
Users can report scheduled or Meet now Microsoft Teams meetings, or individual meeting participants, as security concerns during or after the meeting.
Mdo Support Teams About
Email and collaboration
The article now covers malicious activity in Teams messages, calls, and meetings, and lists messages, calls, meetings, and meeting participants as reportable items. It also links to Teams user reporting settings.
Mdo Support Teams Quick Configure
Email and collaboration
The guide now directs administrators to configure the Allow users to report meetings policy in the Teams admin center. The Defender portal step to verify Monitor reported items in Microsoft Teams remains.
Mdo Support Teams Sec Ops Guide
Email and collaboration
The guide now covers reported Teams meetings and meeting participants, including alert generation and Defender portal review locations. It also corrects alert wording and terminology.
Submissions Teams
Email and collaboration
The documentation now covers reporting Teams meetings and meeting participants, including related metadata, the meeting reporting policy, and updated government-cloud limitations.
Microsoft Defender for Office 365: Changes to Unified RBAC permission mapping for Microsoft Entra Security Operator role
Email and collaboration
Microsoft is updating Microsoft Defender for Office 365's Unified RBAC mapping for the Microsoft Entra Security Operator role, removing default access to email threat policies and Tenant Allow/Block List. This change starts November 2026 and requires manual permission assignment for continued access when Unified RBAC is enabled.
Microsoft Defender for Office 365: Enhancing how we handle promotional mail
Email and collaboration
Microsoft Defender for Office 365 will tag promotional emails as “promotions” and can auto-move them to a Promotions folder, learning from user actions. Public preview starts mid-April 2026; general rollout completes by late 2026. Admins control settings; users can customize via message moves.
Scc Permissions
Email and collaboration
The documentation now describes Data Security AI Admins and the Data Security AI Admin role as editing Data Loss Prevention policies without the previous “related to Copilot” qualifier. Access to view AI content remains documented, while prompt and response access remains excluded.
Defender For Office 365 Whats New
Email and collaboration
Customers in Worldwide environments with Defender for Office 365 Plan 1 or 2, Microsoft 365 E5, or Office 365 E5 can now manage Teams user reporting settings on a separate page from email settings.
Mdo Support Teams Quick Configure
Email and collaboration
The setup instructions now direct administrators to the Teams user reported settings page and its updated URL when verifying Microsoft Teams monitoring. The document date was also updated.
Mdo Support Teams Sec Ops Guide
Email and collaboration
The page date changed to September 28, 2026, and the reporting guidance now links directly to the Teams user reporting settings section.
Submissions Teams
Email and collaboration
The article now points administrators to the Teams user reported settings page and documents Exchange Online PowerShell commands for viewing and configuring Teams report destinations: Microsoft, a reporting mailbox, or both.
Submissions User Reported Messages Custom Mailbox
Email and collaboration
The article’s metadata links and update date changed. Teams-specific explanatory text and several Teams-related parameters were removed from the reported-message policy examples.
Tenant Allow Block List Urls Configure
Email and collaboration
The documentation now states that Unicode is unsupported and Punycode is allowed only in hostname labels before a normal ASCII TLD.
Microsoft Defender for Office 365: Remediation actions from the Teams message entity flyout
Email and collaboration
Microsoft Defender for Office 365 will enhance the Teams message entity flyout by late September 2026, enabling security admins to submit messages to Microsoft and block senders or domains in one workflow. This streamlines Teams message investigations for Plan 1 and Plan 2 customers without requiring configuration changes.
Advanced Delivery Policy Configure
Email and collaboration
The documentation now states that Advanced Delivery applies only when simulation messages traverse the transport pipeline. Direct Injection messages bypass the pipeline and are not covered by the policy.
Advanced Spam Filter (ASF) settings in anti-spam policies
Email and collaboration
The article now describes how ASF settings mark messages as Spam or High confidence spam, clarifies matching .biz and .info URLs, and updates wording for Test mode, sensitive words, and SPF hard fail settings.
Air Report False Positives Negatives
Email and collaboration
The documentation link label changed from “Microsoft Defender for Office 365” to “Microsoft Defender for Office 365 overview”; the linked page is unchanged.
Anti Phishing Policies About
Email and collaboration
The documentation now lists three scenarios where the tip isn’t stamped: S/MIME-signed messages, messages delivered after an SCL -1 bypass rule, and messages sent to mailboxes created less than seven days ago.
Anti Phishing Protection Tuning
Email and collaboration
The article now documents `SFV:SKN` as an example for messages where a mail flow rule skips spam filtering, and adds a related-content link. The page date was also updated.
Anti Spam Policies Configure
Email and collaboration
The article corrects punctuation in the example about routing email through a non-Microsoft protection service before delivery to Microsoft 365.
Anti Spam Protection About
Email and collaboration
The article now defines spam and high-confidence spam by the filtering verdict instead of fixed SCL ranges. It also updates the MarkAsSpamBulkMail explanation and publication date.
App Guard For Office Install
Email and collaboration
The App Guard for Office installation guide now uses an updated Microsoft Support URL for verifying that KB4571756 is installed.
Attack Simulation Training Faq
Email and collaboration
The FAQ now explains that delivery uses each recipient’s mailbox time zone with “not before” logic. Recipients receive simulations at the scheduled local time and never earlier.
Attack Simulation Training Landing Pages
Email and collaboration
Updated the landing page article to say built-in templates are localized into more than 12 languages, use “selecting” instead of “clicking” for checkbox actions, and format related links as list items.
Attack Simulation Training Login Pages
Email and collaboration
The login pages documentation now labels the phishing simulation link “Simulate a phishing attack with Attack simulation training.” The linked page remains the same.
Attack Simulation Training Payload Automations
Email and collaboration
The payload automations article now uses streamlined navigation and deletion instructions and renames a related link to “Reports for Attack simulation training.”
Attack Simulation Training Settings
Email and collaboration
The settings article now links to getting started, phishing simulation, and simulation automation guidance.
Attack Simulation Training Training Campaigns
Email and collaboration
The training campaigns page now links to the getting-started guide and deployment considerations FAQ.
Audit Log Search Defender Portal
Email and collaboration
The page now links to guidance for searching audit log events in Microsoft Defender XDR.
Bulk email detection and bulk complaint level (BCL) in cloud organizations
Email and collaboration
The documentation now states that bulk messages automatically receive the Promotions tag. Enabling Bulk moves enabled routes bulk mail that would otherwise reach the Inbox to the Promotions folder, and user folder actions inform future message handling. The previous rule that added the Bulk tag is no longer required; transport rules can exclude specific senders or recipients.
Campaigns
Email and collaboration
The campaigns documentation now explains that `SFV:SKS` means a message was marked as spam before spam filtering, either by an Exchange mail flow rule that set the SCL or by a spam decision from on-premises Exchange in a hybrid environment.
Configure connection filtering in cloud organizations
Email and collaboration
The documentation now explains that IP Allow List bypasses and SCL 0 are inputs rather than guaranteed final filtering decisions. It also clarifies how to add IP entries and links to mail flow rule guidance.
Configure Junk Email Settings On Exo Mailboxes
Email and collaboration
The article now clarifies that Safe Senders entries do not determine the final spam verdict and that malware, high-confidence phishing, and other detections take precedence. It also reorganizes prerequisites and refreshes PowerShell formatting and wording.
Configure remediation for Microsoft Defender Antivirus detections
Email and collaboration
The article adds specific steps for configuring Microsoft Defender Antivirus remediation settings through Intune and the Microsoft Defender portal, including policy type, platform, template, and configuration settings.
Create Block Sender Lists In Office 365
Email and collaboration
The page date and terminology were updated, “High confidence spam” formatting was standardized, a Mail flow rules in Exchange Online link was added, and one SCL guidance paragraph was commented out.
Create Safe Sender Lists In Office 365
Email and collaboration
The article date was updated and now links to instructions for using mail flow rules to bypass spam filtering, while directing administrators to use the documented conditions and actions to safely allow senders.
Defender For Office 365 Whats New
Email and collaboration
The documentation now states that automatic “Mark as and notify” emails using the default template are localized according to users’ Outlook language settings. Admin-configured custom templates are unaffected.
Detect And Remediate Outlook Rules Forms Attack
Email and collaboration
The article’s summary label and exploit lists were reformatted, and “may need” was changed to “might need” in the investigation guidance.
Email Analysis Investigations
Email and collaboration
The documentation now explains email clustering for SecOps mailboxes and phishing simulations, how Explorer filter exclusions behave, and how pending actions affect remediation status.
Email Authentication Arc Configure
Email and collaboration
The page date was updated to 08/03/2026, and vendor-specific ARC sealer mappings, header examples, and PowerShell configuration steps for Proofpoint, Mimecast, Barracuda, Sophos, and IIJ were removed.
Email Authentication Dkim Configure
Email and collaboration
The documentation changed its wording from “Exchange 2016 and Exchange 2019” to “Exchange 2016 and later” when describing message modifications that can affect DKIM.
Eop About
Email and collaboration
The documentation now states that messages pass through anti-spam and anti-phishing filtering, removing the broader “content filtering” wording.
Get the best security value from Microsoft Defender for Office 365 when you have non-Microsoft email filtering
Email and collaboration
The guide now explicitly covers Microsoft Defender for Office 365 deployments used alongside non-Microsoft email filtering. It adds prerequisites, clarifies built-in protection and Enhanced Filtering guidance, and updates links and operational recommendations.
Handle False Positives In Microsoft Defender For Office 365
Email and collaboration
The guide replaces SCL-based guidance with spam verdict and category values such as SFV:SPM, CAT:SPM, and CAT:HSPM. It also updates BCL examples, remediation steps, and mail-flow rule guidance.
How Policies And Protections Are Combined
Email and collaboration
A footnote was revised for organizations using a non-Microsoft security service or device before Microsoft 365. It references ARC and Enhanced Filtering for Connectors and advises checking service availability.
Inventory delegated From addresses for outbound spam policies
Email and collaboration
A new article explains how to use Exchange Online PowerShell to inventory Send As and Send on behalf permissions and map delegated From addresses to outbound spam policies.
Mdo Integrate Security Service
Email and collaboration
The page now links to the Microsoft Defender for Office 365 overview and getting-started deployment guide.
Mdo Sec Ops Guide
Email and collaboration
The guide now bolds the product area for three roles and adds links to the Microsoft Defender for Office 365 overview and getting-started guide.
Message Headers Eop Mdo
Email and collaboration
The documentation now explains that SCL does not determine spam identification or actions in cloud organizations, and clarifies SFV:SKI, SFV:SKN, and SFV:SKS values and their filtering causes. It also updates bulk-mail and formatting details.
Message Trace Defender Portal
Email and collaboration
A Related content section now links to the Message Trace FAQ in Exchange Online.
Migrate To Defender For Office 365
Email and collaboration
The migration guide’s setup and onboarding navigation entries were synchronized in the documentation.
Migrate To Defender For Office 365 Setup
Email and collaboration
The article now refers to the SCL=-1 rule as the “bypass spam filtering” mail flow rule throughout Step 3, including pilot-group exceptions and rule conditions. The article date and supporting link text were also updated.
Outbound spam limits with Send As and Send on behalf permissions
Email and collaboration
The documentation explains that the message’s From address selects the outbound spam policy, while the authenticated user accumulates recipient counts for Send As and Send on behalf messages.
Outbound Spam Policies Configure
Email and collaboration
The page updates its description of outbound spam handling, records the 2021 history of the Automatic system-controlled forwarding setting, refreshes metadata, and adds links about delegated From addresses and Send As/on behalf permissions.
Outbound Spam Protection About
Email and collaboration
The outbound spam protection documentation now links to guidance explaining how outbound spam policy limits apply to Send As and Send on behalf permissions.
Outbound Spam Restore Restricted Users
Email and collaboration
The article explains that hosted mailboxes use the blocked mailbox UPN, while nonhosted senders use their sending SMTP address when viewing details or removing a restricted sender.
Preset Security Policies
Email and collaboration
The page now places the link to “Order and precedence of email protection” under a dedicated Related content heading.
Prompt Injection Protection Defender For Office 365
Email and collaboration
The guide now states that Defender for Office 365 Plan 2 detects prompt injection content in inbound email, replacing the previous reference to Plans 1 and 2. Examples were reformatted and the article date was updated.
Quarantine About
Email and collaboration
The page now documents that messages quarantined by Safe Attachments policies with unscannable encrypted attachments are retained for 30 days. Admins can release them without a password, while users can provide the password to rescan their own messages.
Quarantine Admin Manage Messages Files
Email and collaboration
The documentation now lists Security Operator alongside Global Reader and Security Reader for read-only and preview/download access to quarantined messages. It also documents handling of encrypted Safe Attachments items and clarifies that Get-QuarantineMessage permission properties reflect the executing user.
Quarantine End User
Email and collaboration
The article now explains that users can provide an attachment password for Safe Attachments rescanning. Safe files are released; malicious or unscannable files remain quarantined. It also documents the one-attempt limit, portal-only release flow, and password safety guidance.
Quarantine Policies
Email and collaboration
The page now explains quarantine policies for Safe Attachments scanning and blocked encrypted attachments, documents related PowerShell parameters and default-policy behavior, and clarifies Get-QuarantineMessage permission properties.
Quarantine Shared Mailbox Messages
Email and collaboration
The documentation now states that users can manage quarantined messages sent to shared mailboxes without automapping. Access through quarantine notifications requires an enabled quarantine policy, notification access, and Full Access permissions to the shared mailbox.
Recommended email and collaboration threat policy settings for cloud organizations
Email and collaboration
The page now recommends Off for automatic forwarding in Standard and Strict profiles. It also adds guidance for blocking unscanned encrypted attachments, excluded attachment types, and quarantine policy when the Safe Attachments response is Block.
Report spam, non-spam, phishing, suspicious emails, Teams messages, and files to Microsoft
Email and collaboration
The article date was updated to July 22, 2026, and a video was added covering how users report suspicious email, attachments, and Teams messages to Microsoft.
Reports Defender For Office 365
Email and collaboration
The documentation no longer states that the report is in preview, unavailable to some organizations, and subject to change.
Responding To A Compromised Email Account
Email and collaboration
The compromised email account article no longer includes the sentence introducing related guidance resources.
Safe Attachments About
Email and collaboration
The documentation now explains quarantining password-protected attachments that cannot be scanned, including release workflows, just-in-time rescanning, file-type exclusions, password limitations, and advanced hunting.
Set up Safe Attachments policies in Microsoft Defender for Office 365
Email and collaboration
The page now documents the Block unscanned attachments option, exclusions for specific file types, quarantine policy selection, and the EnableBlockingEncryptedAttachments PowerShell parameter.
Siem Server Integration
Email and collaboration
The documentation now includes steps for connecting the Microsoft Defender XDR connector in Microsoft Sentinel to stream Microsoft Defender for Office 365 email event data into a SIEM.
Simulation automations for Attack simulation training
Email and collaboration
The page now explains automation execution, including schedule eligibility, run creation, technique and payload selection, user assignment, region-aware delivery, and delivery batches. It also documents supported scenarios and limitations, such as one payload per run and no guarantee of maximum randomized runs.
Spam confidence level (SCL) in Microsoft 365
Email and collaboration
The page now explains that SCL no longer determines spam verdicts or final actions in cloud organizations. It directs admins to use header values such as CAT and DIR, while describing SCL uses for mail flow rules and on-premises Exchange.
Stop And Quarantine File
Email and collaboration
The stop-and-quarantine-file API documentation now uses a repository-relative link to the Microsoft Defender Antivirus compatibility page.
Submissions Admin
Email and collaboration
The page updates headings and submission instructions, formats notes consistently, documents language selection for default automatic notification templates, and adds related links.
Submissions Admin Review User Reported Messages
Email and collaboration
The documentation now states that default automatic notification templates use each user’s preferred Outlook language and are enabled automatically when automatic notifications are turned on. Custom admin-configured templates are unaffected.
Submissions Result Definitions
Email and collaboration
The “Completed | Spam” definition now says similar items are more likely to be identified by spam filtering and handled according to anti-spam policies, replacing the previous SCL-threshold blocking wording.
Submissions Teams
Email and collaboration
The Teams submission steps were lightly reworded, and the documentation now states that reporting requires users with online Teams mailboxes and an Exchange Online reporting mailbox. On-premises mailboxes aren't supported. A related submissions link was also added.
Submissions User Reported Messages Custom Mailbox
Email and collaboration
The documentation now states that reporting mailboxes cannot be distribution groups or external/on-premises mailboxes. It also notes that default investigation-result emails are localized to each recipient’s preferred language.
Submissions Users Report Message Add In Configure
Email and collaboration
The documentation improves wording and formatting for Nested app authentication, Integrated apps navigation, app-registration deletion, and FAQ guidance on deprecation, client updates, and add-in removal.
Tenant Allow Block List About
Email and collaboration
The documentation now states that tenant allow/block list entries apply to messages from both internal and external senders, with special handling for internal spoofing scenarios.
Tenant Allow Block List Teams Domains Configure
Email and collaboration
The article updates permission and portal navigation formatting, adds the Teams senders table’s Value column, and renames the closing section to Related content.
Understand overrides within the email entity page in Microsoft Defender for Office 365
Email and collaboration
The overrides details table was retitled, given a section anchor, reformatted, and updated with revised wording and links, including the SCL -1 mail flow rule explanation.
Zero Hour Auto Purge
Email and collaboration
The documentation now states more clearly that campaign-based remediation can affect messages older than 48 hours, typically within a few hours to a few days after delivery.
Microsoft Defender for Office 365: Prompt injection protection for email
Email and collaboration
Microsoft Defender for Office 365 will introduce prompt injection protection for email, detecting and quarantining malicious content targeting AI assistants. Rolling out from July to October 2026, it affects organizations with Defender Plan 2 or Microsoft 365 E5, enabling automatic high-confidence threat quarantine by default with no required action.
Safe Links About
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/safe-links-about.md.
Tenant Allow Block List Email Spoof Configure
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/tenant-allow-block-list-email-spoof-configure.md.
Tenant Allow Block List About
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/tenant-allow-block-list-about.md.
Email Authentication Arc Configure
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/email-authentication-arc-configure.md.
MDO Encrypted email attachment protection
Email and collaboration
Microsoft Defender for Office 365 will introduce an opt-in Safe Attachments policy to quarantine emails with password-protected attachments that cannot be scanned. Administrators can control release, users can self-release with passwords, and the feature supports various file types. Rollout begins August 2026 worldwide.
Zero Hour Auto Purge
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/zero-hour-auto-purge.md.
Address Compromised Users Quickly
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/address-compromised-users-quickly.md.
Advanced Delivery Policy Configure
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/advanced-delivery-policy-configure.md.
Air Report False Positives Negatives
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/air-report-false-positives-negatives.md.
Allow or block files using the Tenant Allow/Block List
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/tenant-allow-block-list-files-configure.md.
Allow or block URLs using the Tenant Allow/Block List
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/tenant-allow-block-list-urls-configure.md.
Anti Malware Policies Configure
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/anti-malware-policies-configure.md.
Anti Phishing Policies About
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/anti-phishing-policies-about.md.
Anti Phishing Policies Eop Configure
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/anti-phishing-policies-eop-configure.md.
Anti Phishing Policies Mdo Configure
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/anti-phishing-policies-mdo-configure.md.
Anti Spam Policies Configure
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/anti-spam-policies-configure.md.
Anti Spoofing Spoof Intelligence
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/anti-spoofing-spoof-intelligence.md.
Assess and Tune your Filtering for Bulk Mail in Defender for Office 365
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/step-by-step-guides/tune-bulk-mail-filtering-walkthrough.md.
Attack simulation training deployment considerations and FAQ
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/attack-simulation-training-faq.md.
Attack Simulation Training Payload Automations
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/attack-simulation-training-payload-automations.md.
Attack Simulation Training Payloads
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/attack-simulation-training-payloads.md.
Attack Simulation Training Simulation Automations
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/attack-simulation-training-simulation-automations.md.
Audit Log Search Defender Portal
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/audit-log-search-defender-portal.md.
Check your organization's anti-phishing policy DMARC settings
Email and collaboration
Updated Microsoft Defender documentation in defender-office-365/email-authentication-dmarc-configure.md.