Defender for Office 365: what's new

Users can report scheduled or Meet now Microsoft Teams meetings or individual meeting participants as a security concern during or after the meeting. Users can also report a meeting participant that was incorrectly identified as suspicious as not a security concern. Depending on Teams user reported settings, reported meeting and participant metadata is sent to the specified reporting mailbox, to Microsoft, or both.

Users can report completed or missed group Microsoft Teams calls from the call history as malicious (scam) or nonmalicious (non-scam). Depending on user reported settings, reported calls are sent to the specified reporting mailbox, to Microsoft, or both.

Customers in Worldwide (WW) environments with Defender for Office 365 Plan 1, Defender for Office 365 Plan 2, Microsoft 365 E5, or Office 365 E5 can now manage Teams user reporting settings on a separate page at https://security.microsoft.com/securitysettings/teamsUserSubmission. This separation lets you configure different reporting destinations for Teams and Outlook user reports. For more information, see MC1478463.

When automatic notifications use the default template, users receive notification emails in their preferred language based on their Outlook language settings. Custom notification templates configured by admins aren't affected. For more information, see Admin review for user reported messages.

Microsoft 365 E3 now includes Microsoft Defender for Office 365 Plan 1. For more information about what's included in each plan, see Microsoft Defender for Office 365 Plan 1 vs. Plan 2 cheat sheet.

Microsoft Defender for Office 365 now detects prompt injection attacks hidden in inbound email. For more information, see Prompt injection protection in Microsoft Defender for Office 365.

Starting July 2026, new Microsoft Defender for Office 365 Plan 2 organizations use the Microsoft Defender unified role-based access control (Unified RBAC) model by default. For more information, see Configure Unified RBAC for Microsoft Defender for Office 365 and MC1246006.

A new granular Unified RBAC permission Email & collaboration content: Emails associated with alerts (read) allows analysts to preview or download email messages associated with specific security alerts. For more information, see Email entity page actions.

You can configure anti-spam policies to deliver bulk mail below the BCL threshold to the Promotions folder in supported versions of Outlook. For more information, see Deliver bulk mail below the BCL threshold to the Promotions folder.

The ability to remove internal users from Teams chats in the Teams message entity panel is now generally available.

If you have a Microsoft Security Copilot subscription, you can generate an AI summary of email entity data directly from the Email entity page by selecting the Copilot action.

When Users report Microsoft Teams messages from chats, channels (standard, shared, and private), and meeting conversations to Microsoft as malicious (security risk), up to fifteen messages before and after the reported message are shared for analysis.

Users can reported completed or missed one-to-one Microsoft Teams calls from the call history as malicious (scam) or non malicious (non-scam) to the specified reporting mailbox, or Microsoft and the reporting mailbox via user reported settings.

Users can report external and intra-org Microsoft Teams messages from chats, standard, shared, and private channels, meeting conversations to Microsoft as malicious (security risk) the specified reporting mailbox, or both via user reported settings.

Admins can directly block malicious domains and email addresses from within the Microsoft Defender portal, seamlessly adding targeted entries to the Teams Admin Center (TAC) blocked domains and users list. This capability enables near real-time protection. When suspicious or abusive external organizations are identified, SOC teams can immediately block them, effectively halting new external chat messages, invites, and channel communications from those domains and senders while deleting existing ones.

Zero-hour-auto-purge (ZAP) and admin management of quarantined Teams messages is available to Microsoft Defender for Plan 1 by default, bringing a post-delivery protection layer.

This update introduces the ability to perform Submit to Microsoft, Add to TABL and Initiate automated investigation actions directly from the Advanced Hunting interface in Microsoft Defender XDR. These actions, previously only available in Threat Explorer, are now accessible via custom queries in Advanced Hunting, enabling security teams to take investigative and response actions more efficiently and programmatically.

Known, malicious URLs in Teams messages are delivered with a warning. Messages found to contain malicious URLs up to 48 hours after delivery also receive a warning. The warning is added to messages in internal and external chats and channels for all URL verdicts (not just malware or high confidence phishing).

Users can report external and intra-org Microsoft Teams messages as non-malicious (not a security risk) from the following locations:

• Chats
• Standard, shared, and private channels
• Meeting conversations

Users can report external and intra-org Microsoft Teams messages from chats, standard, shared, and private channels, meeting conversations to Microsoft as malicious (security risk) the specified reporting mailbox, or both via user reported settings.

AI-powered Submissions Response introduces generative AI explanations for admin email submissions to Microsoft. For more information, see Submission result definitions.

Defender for Office 365 is now able to detect and classify mail bombing attacks. Mail bombing is a distributed denial of service (DDoS) attack that typically subscribes recipients to a large number of legitimate newsletters and services. The resulting volume of incoming email within minutes intends to overwhelm the recipient's mailbox and email security systems, and acts as a precursor to malware, ransomware, or data exfiltration.

Mail bombing is now an available Detection technology value in Threat Explorer, the Email entity page, and the Email summary panel. Mail bombing is also an available DetectionMethods value in Advanced Hunting.

For more information, see MC1096885.

In government cloud environments, Take action replaces the Message actions drop down list on the Email tab (view) of the details area of the All email, Malware, or Phish views in Threat Explorer (Explorer):

• SecOps personnel can now create organization block entries on URLs and files via the Tenant Allow/Block List directly from Threat Explorer.
• For 100 or fewer messages selected in Threat Explorer, SecOps personnel can take multiple actions on the selected messages from the same page. For example:
• Purge email messages or propose email remediation.
• Submit messages to Microsoft.
• Trigger investigations.
• Create block entries in the Tenant Allow/Block List.
• Actions are contextually based on the latest delivery location of the message, but SecOps personnel can use the Show all response actions toggle to allow all available actions.
• For 101 or more messages selected, only email purge and propose remediation options are available.

Tip

A new panel allows SecOps personnel to look for indicators of compromise at the tenant level, and the block action is readily available.

For more information, see Threat hunting: Email remediation and Remediate Malicious Email: Manual and automated remediation.

You can now create allow entries for domains & addresses and URLs directly in the Tenant Allow/Block List. This capability is available in Microsoft 365 Worldwide, GCC, GCC High, DoD, and Office 365 operated by 21Vianet.

In user reported settings, admins can select Monitor reported messages in Outlook > Use a non-Microsoft add-in button. In the Reported message destination section, select Microsoft and my reporting mailbox, and then provide the email address of the internal Exchange Online mailbox where user-reported messages by the non-Microsoft add-in are routed to. Microsoft analyzes these reported messages and provides result on the User reported tab of Submissions page at https://security.microsoft.com/reportsubmission?viewid=user.

Use the built-in Report button in Outlook: The built-in Report button in Outlook for iOS version 4.2508 or, later and Android version 4.2446 or later now supports the user reported settings experience to report messages as Phishing, Junk, and Not Junk.

Considerations for integrating non-Microsoft security services with Microsoft 365: Considerations and recommendations for deploying a defense-in-depth email security strategy using non-Microsoft security services.

Microsoft Defender for Office 365 now detects BEC attacks using large language model (LLM)-based filters to analyze an email's language and infer intent. To learn more, see our blog post Microsoft Ignite: Redefining email security with LLMs to tackle a new era of social engineering.

The Tenant Allow/Block List now supports allowing and blocking IPv6 addresses. It's available in Microsoft 365 Worldwide, GCC, GCC High, DoD, and Office 365 operated by 21Vianet environments.

Admins can see policy what-if insights for the bulk complaint level (BCL) threshold, spoof, and impersonation settings, which let them understand the implication of a setting change based on historical data. This capability lets admins confidently tune their settings without anxiety about possible repercussions on users.

Use the built-in Report button in Outlook: The built-in Report button in Outlook for Mac v16.89 (24090815) or later now supports the user reported settings experience to report messages as Phishing, Junk, and Not Junk.

We're updating the end user experience for allowlist and blocklist management of their email messages. With one click, users can block email from unwanted senders and prevent those messages from appearing in their default quarantine view and in quarantine notifications. Users can also allow email from trusted and prevent future messages from those senders from being quarantined (if there are no admin overrides). Users also have visibility into any admin overrides that led to a quarantined email message. For more information, see View quarantined email.

With one click, SecOps personnel can take a quarantine release action directly from Explorer (Threat Explorer) or the Email entity page (no need to go to the Quarantine page in the Defender portal). For more information, see Remediate malicious email delivered in Office 365.

(Preview) You can now run simulations with QR code payloads in Attack simulation training. You can track user responses and assign training to end users.

You can now run simulations with QR code payloads in Attack simulation training. You can track user responses and assign training to end users.

Use the built-in Report button in Outlook: The built-in Report button in Outlook for Microsoft 365 now supports the user reported settings experience to report messages as Phishing, Junk, and Not Junk.

We're rolling out new details into who or what was responsible for releasing a message from quarantine. These details are included in the email summary flyout that's accessible from the Quarantine page. For more information, see View quarantined email.

(GA) Learning hub resources have moved from the Microsoft Defender portal to learn.microsoft.com. Access Microsoft Defender XDR Ninja training, learning paths, training modules and more. Browse the list of learning paths, and filter by product, role, level, and subject.

(GA) SecOps personnel can now release email messages from quarantine or move messages from quarantine back to user Inboxes directly from Take action in Threat Explorer, Advanced hunting, custom detection, the Email entity page, and the Email summary panel. This capability allows security operators to manage false positives more efficiently and without losing context. For more information, see Threat hunting: Email remediation.

The value Remove allow entry after > 45 days after last used date is now the default on new allow entries from submissions. The existing allow entries in the Tenant Allow/Block List can also be modified to include the value Remove allow entry after > 45 days after last used date. The allow entry is triggered and the LastUsedDate property is updated when the entity is encountered and identified as malicious during mail flow or at time of click. After the filtering system determines that the entity is clean, the allow entry is automatically removed after 45 days. By default, allow entries for spoofed senders never expire.

Learning hub resources have moved from the Microsoft Defender portal to learn.microsoft.com. Access Microsoft Defender XDR Ninja training, learning paths, training modules and more. Browse the list of learning paths, and filter by product, role, level, and subject.

SecOps personnel can now release email messages from quarantine or move messages from quarantine back to user Inboxes directly from Take action in Threat Explorer, Advanced hunting, custom detection, the Email entity page, and the Email summary panel. This capability allows security operators to manage false positives more efficiently and without losing context. For more information, see Threat hunting: Email remediation.

The Tenant Allow/Block List is now available these environments. They are on parity with the WW commercial experiences.

We're introducing intra-org protection data into three of our core customer facing reports: the Mailflow status report, Threat protection status report, and Top senders and recipient report. Admins and security operators now have insight into how the built-in security features for all cloud mailboxes and Defender for Office 365 protect users from malicious email traffic inside the organization. For more information, see Email security report changes in the Microsoft Defender portal.

The user submission automatic feedback response capability in Microsoft Defender for Office 365 enables organizations to automatically respond to end user submissions of phishing based on the verdict from the automated investigation. Learn more.

Integration with Soft delete: Sender's copy clean-up is incorporated as part of the Soft delete action.

• Wide support: This action is supported across various Defender XDR platforms including Threat Explorer, Take Action wizard from the email entity, Summary Panel, Advanced hunting, and through Microsoft Graph API.
• Undo capability: An undo action is available, allowing you to reverse the clean-up by moving items back to the Sent folder.

You can create block entries under domains & email addresses, using the format .TLD, where TLD can be any top-level domain or .SD1.TLD, .SD2.SD1.TLD, .SD3.SD2.SD1.TLD, and similar patterns for subdomain blocking. The entries block all email received from or sent to any email addresses in the domain or subdomain during mail flow.

We're introducing Sender's copy clean-up features in Threat Explorer, email entity, Summary Panel, and Advanced hunting. These new features streamline the process of managing Sent items, particularly for admins who use the actions Move to mailbox folder > Soft delete and Move to mailbox folder > Inbox. For more information, see Threat hunting: The Take action wizard. Key highlights:

Admins and security operators now see enhanced results within submissions across email, Microsoft Teams messages, email attachments, URLs, and user-reported messages. These updates aim to eliminate any ambiguity associated with the current submission results. The results are refined to ensure clarity, consistency, and conciseness, making the submission results more actionable for you. Learn more.

added to Tenant Allow/Block List entries for domains and email addresses, files, and URLs.

Take action replaces the Message actions drop down list on the Email tab (view) of the details area of the All email, Malware, or Phish views in Threat Explorer (Explorer):

• SecOps personnel can now create organization block entries on URLs and files via the Tenant Allow/Block List directly from Threat Explorer.
• For 100 or fewer messages selected in Threat Explorer, SecOps personnel can take multiple actions on the selected messages from the same page. For example:
• Purge email messages or propose email remediation.
• Submit messages to Microsoft.
• Trigger investigations.
• Block entries in the Tenant Allow/Block List.
• Actions are contextually based on the latest delivery location of the message, but SecOps personnel can use the Show all response actions toggle to allow all available actions.
• For 101 or more messages selected, only email purge and propose remediation options are available.

Tip

A new panel allows SecOps personnel to look for indicators of compromise at the tenant level, and the block action is readily available.

For more information, see Threat hunting: Email remediation.

Attack simulation training is now available in Microsoft 365 DoD. Learn more.

Admins can now duplicate existing simulations and customize them to their specific requirements. This feature saves time and effort by using previously launched simulations as templates when creating new ones. Learn more.

Security teams are now able to see the URLs extracted from QR codes with QR code as URL source on the URL tab of the Email entity page, and QRCode in the UrlLocation column of EmailUrlInfo table in Advanced Hunting. You can also filter for email with URLs embedded within QR codes using the URL Source filter value QR code in the All email, Malware, and Phish views in Threat Explorer (Explorer).

Admins can identify if they're submitting an item to Microsoft for a second opinion or they're submitting the message because it's malicious and was missed by Microsoft. With this change, Microsoft analyses of admin submitted messages (email and Microsoft Teams), URLs, and email attachments are further streamlined and results in a more accurate analysis. Learn more.

Teach your users to recognize and protect themselves against QR code phishing attacks. For more information, see this blog post.

Defender unified RBAC supports all Defender for Office 365 scenarios previously controlled by Email & collaboration permissions and Exchange Online permissions. To learn more about the supported workloads and data resources, see Microsoft Defender unified role-based access control (RBAC).

Tip

Defender unified RBAC isn't generally available in Microsoft 365 Government Community Cloud High (GCC High) or Department of Defense (DoD).

New detection capabilities using image detection, threat signals, URL analysis now extracts QR codes from URLs and blocks QR code based phishing attacks from the body of an email. To learn more, see our blog.

As part of the change security admins can take multiple actions as part of FP/FN flows. Learn more.

The Tenant Allow/Block Listsupports more entries in each category (Domains & email addresses, Files, and URLs):

• Microsoft Defender for Office 365 Plan 2 supports 10,000 block entries and 5,000 allow entries (via admin submissions) in each category.
• Microsoft Defender for Office 365 Plan 1 supports 1,000 block entries and 1,000 allow entries (via admin submissions) in each category.
• Default protection in Microsoft 365 remains at 500 block entries and 500 allow entries (via admin submissions) in each category.

in Attack simulation training. Learn more

In addition to the existing support for Email & collaboration permissions, Defender unified RBAC now also supports protection-related Exchange Online permissions. To learn more about the supported Exchange Online permissions, see Exchange Online permissions mapping.

Attack simulation training is now available in Microsoft 365 GCC High. Learn more.

URL top-level domain blocking is available in the Tenant allow block list. Learn more.

By default, messages sent between internal users that are identified as high confidence phishing are quarantined. Admins change this setting in the default anti-spam policy or in custom policies (opt-out of intra-org protection or include other spam filtering verdicts). For configuration information, see Configure anti-spam policies.

If the User reported settings in the organization send user reported messages (email and Microsoft Teams) to Microsoft (exclusively or in addition to the reporting mailbox), we now do the same checks as when admins submit messages to Microsoft for analysis from the Submissions page.

Use anti-phishing policies to control what happens to messages where the sender fails explicit DMARC checks and the DMARC policy is set to p=quarantine or p=reject. For more information, see Spoof protection and sender DMARC policies.

User tagsare now fully integrated with Defender for Office 365 reports, including:

• Threat protection status report
• Compromised users report
• Top senders and recipients report
• URL protection report

Built-in reporting in Outlook on the web supports reporting messages from shared mailboxes or other mailboxes by a delegate.

• Shared mailboxes require Send As or Send On Behalf permission for the user.
• Other mailboxes require Send As or Send On Behalf permission and Read and Manage permissions for the delegate.

Training only campaigns available with an expanded library: You can now directly assign training content to your organization without needing to tie training to a phishing simulation campaign. We also expanded our training module library to more than 70 different modules.

Using machine learning to drive more effective simulations in Attack Simulation and Training: Make use of intelligent predicted compromise rate (PCR) and Microsoft Defender for Office 365 payload recommendations for utilizing high-quality payloads in your simulation.

By default, Microsoft now protects URLs in email messages at time of click as part of this update to Safe Links settings (EnableSafeLinksForEmail) within the Built-in protection preset security policy. To learn about the specific Safe Links protections in the Built-in protection preset security policy, see Safe Links policy settings.

With the increased use of collaboration tools like Microsoft Teams, the possibility of malicious attacks using URLs and messages has increased as well. Microsoft Defender for Office 365 is extending its Safe Links protection with increased capabilities for zero-hour auto purge (ZAP), quarantine, and end user reporting of potential malicious messages to their admins. For more information, see Microsoft Defender for Office 365 support for Microsoft Teams (Preview).

If your organization enabled or will enable the Standard or Strict preset security policies, the policies are automatically updated to use the new DefaultFullAccessWithNotificationPolicy quarantine policy (notifications enabled) wherever the DefaultFullAccessPolicy (notifications disabled) was used. To learn more about quarantine notifications, see Quarantine notifications. For more information about specific settings in preset security policies, see Recommended email and collaboration threat policy settings for cloud organizations.

Microsoft now automatically removes allow entries from the Tenant Allow/Block List once the system has learned from it. Alternatively, Microsoft extends the expiration time of the allow entries if the system hasn't learned yet. This behavior prevents legitimate email from going to junk or quarantine.

We expanded "Simulation URLs to allow" limit to 30 URLs. To learn how to configure, see Configure the delivery of non-Microsoft phishing simulations to users and unfiltered messages to SecOps mailboxes

Enhanced user telemetry in the simulation reports in Attack Simulation Training: As part of our enhanced user telemetry, administrators can now view more details about how their targeted users are interacting with the phishing payload from phishing simulation campaigns.

The new Microsoft Defender XDR role-based access control (RBAC) model, with support for Microsoft Defender for Office, is now available in public preview. For more information, see Microsoft Defender XDR role-based access control (RBAC).

Use the built-in Report button on Outlook: Use the built-in Report button in Outlook on the web and new Outlook for Windows client to report messages as phish, junk, and not junk.

Automated Investigations email cluster action deduplication: We added more checks. If the same investigation cluster is already approved during the past hour, new duplicate remediation isn't processed again.

• With the new lookback scenario, the "A potentially malicious URL click was detected" alert now includes any clicks during the past 48 hours (for email) from the time the malicious URL verdict is identified.

Manage allows and blocks in the Tenant Allow/Block List:

• With allow expiry management (currently in Private Preview), if Microsoft hasn't learned from the allow, Microsoft automatically extends the expiry time of allows, which are going to expire soon, by 30 days to prevent legitimate email from going to junk or quarantine again.
• Customers in government cloud environments are now able to create allow and block entries for URLs and file attachments in the Tenant Allow/Block List using admin submissions for URLs and email attachments. The data submitted through the submissions experience doesn't leave the customer organization, thus satisfying the data residency commitments for government cloud clients.

• For spoofing protection, the allowed senders or domains defined in the anti-spam policy and within user allowlists must now pass email authentication for the allowed messages to be honored. The change only affects messages that are considered to be internal (the sender or sender's domain is in an accepted domain in the organization). All other messages continue to be handled as they are today.

Automatic redirection begins for users accessing the security solutions in Office 365 Security & Compliance center (protection.office.com) to the appropriate solutions in Microsoft Defender portal (security.microsoft.com). This change is for all security workflows like (for example, Alerts, Threat Management, and Reports).

• Redirection URLs:
• GCC Environment:
• From Office 365 Security & Compliance Center URL: protection.office.com
• To Microsoft Defender XDR URL: security.microsoft.com
• GCC-High Environment:
• From Office 365 Security & Compliance Center URL: scc.office365.us
• To Microsoft Defender XDR URL: security.microsoft.us
• DoD Environment:
• From Office 365 Security & Compliance Center URL: scc.protection.apps.mil
• To Microsoft Defender XDR URL: security.apps.mil

The action center in the Email & Collaboration section Email & collaboration > Review > Action centerhttps://security.microsoft.com/threatincidents is automatically redirected to Actions & Submissions > Action center > Historyhttps://security.microsoft.com/action-center/history.

A profile that enables a base level of Safe Links and Safe Attachments protection that's on by default for all Defender for Office 365 customers. To learn more about this new policy and order of precedence, see Preset security policies. To learn about the specific Safe Links and Safe Attachment controls that are set, see Safe Attachments settings and Safe Links policy settings.

is now available in the EmailEvents table in Advanced Hunting with numeric BCL values from 0 to 9. A higher BCL score indicates that bulk message is more likely to generate complaints and is more likely to be spam.

Global Administrators^\*^ and Security Administrators can turn on or off redirection in the Microsoft Defender portal by navigating to Settings > Email & collaboration > Portal redirection and switch the redirection toggle.

Important

^\*^ Microsoft strongly advocates for the principle of least privilege. Assigning accounts only the minimum permissions necessary to perform their tasks helps reduce security risks and strengthens your organization's overall protection. Global Administrator is a highly privileged role that you should limit to emergency scenarios or when you can't use a different role.

Items in the Office 365 Security & Compliance Center unrelated related to security aren't redirected to Microsoft Defender XDR. For compliance solutions redirection to Microsoft 365 Compliance Center, see Message Center post 244886.

Redirection is enabled by default and impacts all users of the Tenant.

This change enables users to view and manage other Microsoft Defender XDR security solutions in one portal.

This change impacts all customers who use the Office 365 Security & Compliance Center (protection.office.com). For example:

• Microsoft Defender for Office (Plan 1 or Plan 2)
• Microsoft 365 E3 / E5
• Office 365 E3 / E5

For the full list, see Microsoft 365 guidance for security & compliance.

This change impacts all users who sign in to the Office 365 Security and Compliance portal (protection.office.com), including security teams and end-users who access the Email Quarantine experience, at the Microsoft Defender Portal > Review > Quarantine.

This change is a continuation of Public Sector Blog - Microsoft Defender XDR delivers unified XDR experience to GCC, GCC High, and DoD customers, announced in March 2022.

Introducing actions into the Email entity page: Admins can take preventative, remediation, and submission actions from the Email entity page.

Configurable impersonation protection custom users and domains and increased scope within Preset policies:

• (Choose to) Apply Preset Strict/Standard policies to entire organization and avoid the hassle of selecting specific recipient users, groups, or domains, thereby securing all recipient users of your organization.
• Configure impersonation protection settings for custom users and custom domains within Preset Strict/Standard policies and automatically protect your targeted users and targeted domain against impersonation attacks.

Create allow entries for spoofed senders: Create allowed spoofed sender entries using the Tenant Allow/Block List.

Impersonation allows using admin submission: Add allows for impersonated senders using the Submissions page in Microsoft Defender XDR.

Introducing differentiated protection for priority accounts in Microsoft Defender for Office 365: Introducing GCC, GCC-H, and DoD availability of differentiated protection for priority accounts.

Simplifying the quarantine experience (part two) in Microsoft Defender XDR for office 365: Highlights additional features to make the quarantine experience even easier to use.

Submit user reported messages to Microsoft for analysis: Configure a reporting mailbox to intercept user-reported messages without sending the messages to Microsoft for analysis.

View the associated alerts for user reported messages and admin submissions: View the corresponding alert for each user reported phishing message and admin email submission.

Introducing differentiated protection for priority accounts in Microsoft Defender for Office 365: Introducing the general availability of differentiated protection for priority accounts.

Introducing the URLClickEvents table in Microsoft Defender XDR Advanced Hunting: Introducing the UrlClickEvents table in advanced hunting with Microsoft Defender for Office 365.

Manual email remediation enhancements: Bringing manual email purge actions taken in Microsoft Defender for Office 365 to the Microsoft Defender XDR (M365D) unified Action Center using a new action-focused investigation.

Streamlined the submission experience in Microsoft Defender for Office 365: Introducing the new unified and streamlined submission process to make your experience simpler.

Updated Hunting and Investigation Experiences for Microsoft Defender for Office 365: Introducing the email summary panel for experiences in Defender for Office 365, along with experience updates for Threat Explorer and Real-time detections.

Advanced Delivery DKIM enhancement: Added support for DKIM domain entry as part of non-Microsoft phishing simulation configuration.

Secure by Default: Extended Secure by Default for Exchange mail flow rules (also known as transport rules).

Improved reporting experience in Defender for Office 365

Portal redirection by default begins, redirecting users from the Security & Compliance Center to Microsoft Defender XDR https://security.microsoft.com.

Quarantine policies: Admins can configure granular control for recipient access to quarantined messages and customize end-user spam notifications.

• Video of admin experience
• Video of end-user experience
• Other new capabilities coming to the quarantine experience are described in this blog post: Simplifying the Quarantine experience.

You can now add allow entries to the Tenant Allow/Block List if the blocked message was submitted as part of the admin submission process. Depending on the nature of the block, the submitted URL, file, and/or sender allow entries are added to the Tenant Allow/Block List. In most cases, the allows entries are added to give the system some time and allow it naturally, if warranted. In some cases, Microsoft manages the allow entries for you. For more information, see:

• Report good URLs to Microsoft
• Report good email attachments to Microsoft
• Report good email to Microsoft

Admin review for reported messages: Admins can now send templated messages back to end users after they review reported messages. The templates can be customized for your organization and based on your admin's verdict as well.

Advanced Delivery: Introducing a new capability for configuring the delivery of non-Microsoft phishing simulations to users and unfiltered messages to security operation mailboxes.

Email analysis improvements in automated investigations

Microsoft Defender for Office 365 alerts is now integrated into Microsoft Defender XDR - Microsoft Defender XDR Unified Alerts Queue and Unified Alerts Queue

New alert policies for the following scenarios: compromised mailboxes, Forms phishing, malicious mails delivered due to overrides and rounding out ZAP

• Suspicious email forwarding activity
• User restricted from sharing forms and collecting responses
• Form blocked due to potential phishing attempt
• Form flagged and confirmed as phishing
• New alert policies for ZAP

Safe Links for Microsoft Teams

User Tagsare now integrated into Microsoft Defender for Office 365 alerting experiences, including: the alerts queue and details in Office 365 Security & Compliance, and scoping custom alert policies to user tags to create targeted alert policies.

• Tags are also available in the unified alerts queue in the Microsoft Defender portal (Microsoft Defender for Office 365 Plan 2)

New first contact safety tip setting within anti-phishing policies. This safety tip is shown when recipients first receive an email from a sender or don't often receive email from a sender. For more information on this setting and how to configure it, see the following articles:

• First contact safety tip
• Configure anti-phishing policies if you don't have Microsoft Defender for Office 365
• Configure anti-phishing policies in Microsoft Defender for Office 365