Take action replaces the Message actions drop down list on the Email tab
Take action replaces the Message actions drop down list on the Email tab (view) of the details area of the All email, Malware, or Phish views in Threat Explorer (Explorer):
- SecOps personnel can now create organization block entries on URLs and files via the Tenant Allow/Block List directly from Threat Explorer.
- For 100 or fewer messages selected in Threat Explorer, SecOps personnel can take multiple actions on the selected messages from the same page. For example:
- Purge email messages or propose email remediation.
- Submit messages to Microsoft.
- Trigger investigations.
- Block entries in the Tenant Allow/Block List.
- Actions are contextually based on the latest delivery location of the message, but SecOps personnel can use the Show all response actions toggle to allow all available actions.
- For 101 or more messages selected, only email purge and propose remediation options are available.
Tip
A new panel allows SecOps personnel to look for indicators of compromise at the tenant level, and the block action is readily available.
For more information, see Threat hunting: Email remediation.
Terms in this update
This is in the weekly digest for week 39 · What changed this week? →
More Defender for Office 365 updates
Expanding user reporting in Teams to include meetings
Expanding user reporting in Teams to include group calls
Separating Teams user reporting settings from email settings
Localized default Mark as and notify email templates
Microsoft Defender for Office 365 Plan 1 included in Microsoft 365 E3
Prompt injection protection
Text by Microsoft, from Microsoft's documentation. Features and dates may change. Terms and the timeline are added by 365Fanatic.
