Learn Microsoft 365 Threat Protection Policies in just 20mins

This time we delve into the world of Microsoft security and explore the Threat Protection policies within Microsoft Defender for Microsoft 365. From Anti-virus, to Anti-Malware and Anti phishing to Safe links and safe attachments. These are simply a set of tools that you simply have to know. So if you’re a fledgling security pad wan, then this session will turn you into a security Jedi. As always if you enjoy please hit the like button.
Please visit my site www.Andymalone.org

[@BahruzAbseynov2024]

Thank you Andy for your tutorials.

[@pisse3000]

100% on the money about the community aspect!! I love it here 👍

[@ThomasFiskerJepsen]

I think it is wonderful that you have the “chit-chat” part of your videos! :) Looving it!

[@patrick__007]

Keep up doing the good work Andy. As always I enjoyed watching your content. Hope you feel better soon!

[@AndyMaloneMVP]

Thanks Patrick I appreciate that. All the best.

[@rajarajank6705]

Hi Andy, happy to see you back, don't stress much for few more days , better to take rest for few more days

[@AndyMaloneMVP]

I’ll try but I have a speaking engagement in 2 days. But then I’ll slow down 🤗

[@BradBoth]

Andy, I don't think I've ever commented on a video but you broke me! I just wanted to say thanks for all this information. This has been immensely helpful.

[@AndyMaloneMVP]

Hey Brad I’m delighted to hear that and thanks so much for your kind comment. All the very best, Andy

[@jeorgefrasco8286]

Hello Andy, Thank you very much!

[@MrBitviper]

amazing video. this was very informative

[@keagankeno5382]

I watch your videos for insight into the Microsoft ecosystem. You have excellent insight.

[@AndyMaloneMVP]

Thank you, and I’m delighted to hear that you’re enjoying my channel 👍

[@omjayaram]

Thank you Andy for your contribution

[@AndyMaloneMVP]

My pleasure thanks 😊

[@tony6626]

Really loving your content Andy, thanks for sharing. Wish i'd found you sooner :)

[@AndyMaloneMVP]

Thank you so much Tony that means a lot to me. The important thing is you found me now and I really hope that my content helps. Welcome to the community and great to have you on board.😊👍

[@arshadarshu3243]

Really great information

[@d7oomy5500]

Thank you for great explanation i was confused with a lot of concepts and i'm new at EOP it helped me

[@AndyMaloneMVP]

Glad it helped!

[@d7oomy5500]

@@AndyMaloneMVP Is there a video talk about Email investigation?

[@jacobpizur8503]

Andy is the best. Like that IT uncle we all had, but less creepy and way more helpful

[@AndyMaloneMVP]

Whew I’m so glad to hear that 😆

[@jacobpizur8503]

@@AndyMaloneMVP lol i used to work in chemistry and recently made my move to tech. im a 365 admin. your a life saver man!!! thanks for everything you do

[@AndyMaloneMVP]

@@jacobpizur8503 hi Jacob, hey that’s great I’m so glad to hear that. The very best of luck with your new career. 😊 👍

[@shivamanand8998]

Thanks very easy to understand

[@AndyMaloneMVP]

My pleasure and thanks for the nice comment👍😊

[@anoopmathen4566]

Thanks andy

[@soodshubham7671]

Thank you Andy Sir for this video. Please create a few videos on Powershell.

[@AndyMaloneMVP]

Here you go kzbin.info/www/bejne/mGi2eIOZnb6FpJI

[@JeroenHensing]

You should have more upvotes.. +1 from me... really enjoy the videos..

[@AndyMaloneMVP]

Aw thank you most kindly 😊

[@mohammedhisham6114]

another request, I appreciate it if you can review a bit in-depth the SMTP auth. that you earlier mentioned in the previous video.

[@Sekbeth]

Hi Andy, recently found you and really love your videos. They are so helpful. I’m finding the licensing for these functions a little confusing. We have a business that uses business standard, but want to set up some of these features to prevent data theft. Do all users need the E3/E5 licence to put these feature into effect?

[@AndyMaloneMVP]

You read my mind! I’m going to answer your question in a new short that I’m going to produce in the next couple of days watch out for it.

[@Sekbeth]

@@AndyMaloneMVP that’s awesome! Thank you Andy. I’ll keep a lookout for it!

[@mohammedhisham6114]

Thanks again Andy for the awesome content! Actually, I was looking forward to hearing about using antimalware and safe attachments when they work simultaneously, and how we can properly set the priority on which one should be higher in that sense. I tried to test the safe attachment policy but anti-malware works first and catch the email with the test attachment. any good hints?

[@AndyMaloneMVP]

You’re right Mohammed they are two different technologies but I would say safe attachments is a better solution as sometimes EOP let’s bad stuff through. There is often a delay in safe attachments when you switch it on. Generally they do work together but EOP always runs first. You can set priorities with PowerShell. Check out docs.Microsoft.COM they have Coll some great articles.

[@mohammedhisham6114]

@@AndyMaloneMVP thx for your reply Andy! So, do you recommend to disable anti-malware policy to let safe attachment lead the safeguard?

[@AndyMaloneMVP]

@@mohammedhisham6114 no let them both run. Best practice 👍

[@98854arjun]

Thanks from India

[@AndyMaloneMVP]

You’re welcome 👍

[@markushartmann4721]

Andy, Thank you so much for your content. On this EOP we have experienced some features we are not very happy with. we are trying to block all potential OfficeMacro file types and have them delivered to the quarantine for verification by an admin. M365 Defender does not give an option for such a situation. Senders and or recipients are informed that there has been a malware detected. Even with Exchange Online, there is no option to adapt that message from "suspicious / risky file type" instead of "malware".

[@AndyMaloneMVP]

Thanks very much for your question. I’m sure you’ll appreciate that for specific questions relating to a product like this I have to point you towards docs.microsoft.com or consult with the Microsoft technical community this is by far the best way to get your solutions. Thanks again

[@MrJsysco]

Do you know the strategy MSFT has for changing names? Just thought it may be a “documented” MSFT item that you would know. 😏. Great content! Keep the jibber jabber with the content!!

[@AndyMaloneMVP]

Thanks very much. Yes there is a ton of information on this docs.microsoft.com you should check it out just do a search for windows defender for 365 and also exchange online protection. In terms of a strategy! Not that I’m aware of. However that doesn’t mean to say that one doesn’t exist. Good luck and thanks again.

[@creativeanalyst-yz9sy]

Can u please create a content regarding Powershell from A to Z ?

[@Rahgozar633]

Hi Andy, I really love your content. I have a request. Can you please show with examples how we can analyze the quarantined mails. How can we find out why an email was quarantined. Thanks

[@AndyMaloneMVP]

I’ll add it to my list and thanks 😊

[@Rahgozar633]

@@AndyMaloneMVP Great thanks

[@ML_1515]

Thanks for the video. Have a couple of questions. Can multiple polices be applied to the same user? For example if there are two anti-spam policies...one with higher and one with lower priority. What if there are conflicting settings between the two policies? Thanks!

[@AndyMaloneMVP]

The most restrictive is the most effective.

[@ML_1515]

@@AndyMaloneMVP Thanks. I found more information here: docs.microsoft.com/en-us/microsoft-365/security/office-365-security/how-policies-and-protections-are-combined?view=o365-worldwide "If a recipient is defined in multiple policies of the same type (anti-spam, anti-phishing, etc.), only the policy with the highest priority is applied to the recipient. Any remaining policies of that type are not evaluated for the recipient (including the default policy)."

[@supriyochatterjee4095]

Hope your health is better now stay safe , God bless all

[@AndyMaloneMVP]

Thank you I appreciate that.

[@Comoplantardinheiro]

Hey Andy, how its going ? How could I monitoring everything? the links safe, the bad attachments and others thinks? Is there any report of who click or access something ? A list of URL blocked by Links safe? thanks for helping.

[@AndyMaloneMVP]

Security logs in Defender for 365

[@JunglasGelenkwellendienstGmbH]

Do those features require a connected MS Exchange account, or will an usual IMAP mail account be enough?

[@AndyMaloneMVP]

O MS Outlook accounts are much more secure than Traditional imap

[@f.k.b.16]

Should I use the @ sign when adding domains to the whitelist?

[@AndyMaloneMVP]

Read the guide unlearn.microsoft.com @ is the record name

[@keagankeno5382]

How good is the default setting for anti-phishing? I find adjusting that threshold causes a lot of emails to be caught by the phishing policy. A lot of legitimate emails.

[@AndyMaloneMVP]

Honestly, I think they’re pretty good. It’s what I use most of the time. However, a lot of people get confused between junk email, and the focused inbox, which used to be clutter. Which of course it’s just a way of organising your email so that the important stuff can be actioned first. No, I think the default rules are pretty good.

[@keagankeno5382]

@@AndyMaloneMVP Thanks Andy, that's helpful.

[@TheRahulamrit]

have E3 license but can't see these options for me

[@AndyMaloneMVP]

You need EM&S

[@esporamoralestilo]

onda que esta todo en español. pero hablas en ingles.. yo se que tengo que aprender... pero esa es la segunda etapa de mi vida.

[@AndyMaloneMVP]

Espero que los subtitulos cxan ayuden. :-)

[@ChristopherSimmons-ry9pc]

Turn off safe Link

[@AndyMaloneMVP]

Why?