Secure messages by using Microsoft 365 Defender

0:00[AUDIO LOGO] Hello, and thank you for joining me in this Nugget as we look at configuring anti-phishing policies. Now, if you're going to find yourself with a team within your organization where the concern is how best we protect our users from anti-phishing-- let's imagine that there is a hook over there and a fishing image-- we actually have to look at a number of things before we can go ahead and say, this is what we're going to do. Now, some of those things that we have to look into are the various threat intelligence sources that we have within our environment because this is where we get the feeds in terms of what is training in a cybersecurity environment, and what exactly is being attacked, what methods are being used, and how best do we make sure that each and every user within our environment is actually protected against those.

0:52So by making use of a threat intelligence sources, whether those are recommended by Microsoft or other large vendors in our environment, we'd then be able to look into how best we could accurately create an anti-phishing policy within our environment. And then after the whole threat intelligence sources have directed us, we then can begin looking at the various areas around Exchange Online, for example, being able to look at the various filtering configurations that we can do that actually allow us to be able to thwart those messages that are likely to be malicious within our environment.

1:23Exchange Online is really key in ensuring that our protection for the various mailboxes that exist within the environment is enforced. In addition to that, it is very important for us to make sure that we have sender authentication implemented within our environment. Now, what's an authentication simply does is that it makes use of various protocols, such as sender policy framework, domain keys, identification mail, and many others to simply verify the authenticity of those particular emails that are coming into your organization. In essence, the implementation of these protocols would simply enhance your security by ensuring that each and every email that is sent to your users is actually taken through a process of verifying its authenticity of vetting it, finding itself within your environment.

2:06And that vetting would prevent malicious attacks, such as domain spoofing, where a malicious attacker would simply be able to replicate a particular domain and thereby send out an email that may end up compromising the security of your environment. So armed with the rightful information and the best configuration practices, you just have to protect, refine, and repeat. The protection part simply means that you're going to select the various users or mailboxes that are simply supposed to be included in your phishing configuration. So if your policy is targeting the Sales department, you have to make sure that those groups and users within the cell's department are included.

2:41Now, there are times when you would like to exclude certain users. If it is necessary that you exclude maybe the executives, you have to go ahead and exclude those users maybe for training purposes, or you've got a system limitation, or maybe you simply want to avoid having a lot of false positives, et cetera. Now, the fact that you've configured your protection part doesn't mean that everything is good, and you sit and relax. You have to continually refine. This simply looks into running updates for those particular policies whenever necessary. You have to constantly review and make sure that your policies are actually in line with the various trends that you've picked up from your threat intelligence sources and that your users are secure.

3:20And that process has to be repeated through and through in order for us to make sure that our environment are secure. Well, without further ado, let's dive into Microsoft 365 and look at how we can configure our phishing policies. So here we are within Microsoft 365 admin center. Let's go ahead and access our Security admin center. And here within our Security admin center, notice that Microsoft 365 Defender opens up. And we simply have to go and access Email and collaboration. Now, it's in this area that we can access policies and rules, and thereby having access to threat policies, where we can create our phishing policies.

3:55So if we scroll down, there we have anti-phishing policies. So go ahead and open that. And then we can start the process of creating our own. Now, you'd realize that there is a default anti-phishing policy that Microsoft already had put for us over here. But if we create one, it should actually take precedence. Why? Because this is just default. So we want to customize something for organization. So let's say this is going to be for our Sales team, and this is going to be to protect our Sales team from phishing attacks. So go ahead and click Next over there. And here, we have to decide whom among the Sales team has to take part in this particular policy.

4:31So it could be a particular user, or it could be a group. And if you're going to be dealing with groups, you have to ensure that those groups are either Microsoft 365 groups or distribution list that you have in your environment, as those are the easiest to work with when it comes to implementing phishing policies using groups within Microsoft 365. You can also make use of domains. This is very prominent for organizations that may have different domains. Maybe you have a Sales team that have a different domain. You can go ahead and simply specify that over there. Now, in this case, I just go ahead and type Sales.

5:02I've got a Sales department group over here. So go ahead and select the Sales team. If you have multiple groups within your environment, it's very much possible for you to go ahead and select all those that are supposed to participate in that policy. There are times when you really have to exclude certain users. If that's something that you'd like to do, then you can go ahead and click over there and exclude those users. It is possible that you might have maybe users that aren't supposed to be included due to special circumstances that you may have in your organization. And this is where you would simply add those users over here. Let's go ahead and click Next. This area over here simply looks at how aggressive this particular policy is going to be.

5:37And if you really make it to be more aggressive, that simply means you may end up finding yourself in a scenario, whereby even information that is not regarded as a phishing attack could actually be prevented from making its way to your mailbox. So it's quite important to make sure that this is in line with what you want to do by making it a little bit more moderate. So if you're getting a lot of false positives, or simply reports from users who are complaining to say the emails that were previously receiving in their mailboxes are no longer coming through, this is where you simply have to come and make adjustment.

6:08Over here, we can simply protect impersonation, where another user maybe externally or internally can actually be impersonated. By simply enabling this feature, that would prevent that. And we can have up to 350 users or mailboxes protected by making use of this feature over here. And then we have Enable domain protection. If we have multiple domains within our environment, whether these are domains that we own or domains of our partners and suppliers, we can simply make adjustments over here. For example, if I went to view my domains, if we had multiple domains within this picture a tenant, we'd simply be able to have them listed over here.

6:42And we could also have those protected within their environment. Now, imagine that we were a retailer company, and we have multiple suppliers who actually provide the various produce and merchandise that we actually trade. It's important for us to actually go ahead and include them over here. And that would allow us to make sure that each and every time such messages are coming through, we are assured that the messages that we are receiving are coming from legitimate domains. If we scroll down once, you'd realize we have Enable mailbox intelligence, which is recommended over there.

7:13And then we have Enable intelligence for impersonation protection also recommended, Enable spoof intelligence also recommended. Now, these are features that we simply have to make sure that they are available each and every time we're configuring our anti-phishing policies, as they help enhance that security. So if we go ahead and click Next, we have this particular area where we have multiple actions to carry out. Now, the actions simply define what should happen in the event that there is a violation of this particular policy. For example, if a message is detected as user impersonation, what should happen?

7:43Should it be redirected to a particular email address? This can become handy if you have maybe an admin who is watching over what is happening with your environment. And they can always be able to respond every time there's this kind of scenario. So what you'd like to do is to make sure that each and every time there is that kind of a message, the recipient should actually receive it. But then that particular admin should be the one to look into that message upon receiving it and verify whether it is authentic and take further action. Now, the best practice for this is just to delete the message. But also, deleting messages may save us from being victims.

8:16However, it may deny us our chance to really be able to get inside information regarding the perpetrators intentions. And the same can be applied to the domains. If we detect domain impersonation, what should we do within our environment? Should we quarantine the message? Or should we delete the message before it is delivered? You have mailbox intelligence over here. We also have others, such as if message is detected as a spoof by spoof intelligence, we actually want to maybe quarantine that message and let our own look into what is happening. Now, you may have additional quarantine policies that may specify for how long that message should be kept in quarantine, et cetera, the escalation procedures, and so on and so forth.

8:54But over here, we have the safety tips, which are also very important indicators that users can simply be notified of each and every time there is suspicious information that has been shared. For instance, we could look at Show contact safety tips, which is actually recommended. And that is simply there to notify the recipient when there is something that is happening that is unusual. Unusual activity may include receiving an email from a particular sender for the very first time. So if that email is coming into my mailbox for the first time, I'll be notified to say, hey, you know what, this sender is sending an email for the very first time.

9:25Take caution. So we have others here, such as Short user impersonation tips. You have Show domain impersonation tips. All of these would be very helpful for the various users that we have within our environment in their everyday work life to identify anything that is likely to cause harm to environment. And this is where also user training becomes very important because if your users are unable to actually identify those tips, it becomes very difficult for them to know when they are vulnerable and when they are not. With these changes down over here, we go ahead and click Next.

9:58And then we can have a quick review of the configuration. And if everything regarding your phishing policy looks perfect, then you can go ahead and submit that. And eventually, that policy becomes enabled, or it simply goes on. And over here, you can actually see that the policy takes precedence. And your Sales teams will be protected. So this is how, my friend, we can make use of phishing policy within our environment to protect the various users that we have as they collaborate. For now, I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] Nobody enjoys it. And it's not good. We're going to look at how we can stop spam messages by configuring anti-spam policies within Microsoft 365. Now, spam messages are one of the menaces that we actually have to manage within our environment. And these can actually be very distracting and time-consuming for our users, whether they'd be ads, or maybe they're sales pitches, or whatever it that is being sent away from unknown domains, maybe to sell us something, or simply ask us to participate in a particular activity.

0:34And within Microsoft 365, we have means through which you can actually manage these by making sure that our users are not bombarded by unnecessary spam messages. So back in our Microsoft 365 admin center, let us access Microsoft 365 Defender by going to Security. And over here, we'll go back to Email and collaboration and access Policies and rules. And then go back and access Threat policies. So let us proceed by clicking on anti-spam. This is where we can actually define what should be happening to our spam messages.

1:06And each and every time we actually get an email that is detected as spam, what action must be taken in the event of receiving such message? One thing you would notice when creating your custom anti-spam policies is that you have two rules. It's either going to be an inbound anti-spam policy or an outbound anti-spam policy. Now, if you're really concerned about all the messages coming in from various sources that may actually end up as spam within your mailboxes, then that kind of policy must be an inbound anti-spam policy.

1:37So this could be for the entire organization, or simply a group of users that you have within your environment. So with that in place, you can go ahead and create your anti-spam policy. You have your name. You can give a short description, detailing what exactly that particular policy is doing. And then you can go ahead and click Next. So here, we have to specify, just like we did in the previous Nugget, where we have to specify the users or the domains or the groups, et cetera. So over here, simply go ahead and say this is going to be for my Sales team. And I'll select the Sales teams that I have within my tenant.

2:10And with that in place, we can go ahead and exclude certain users or groups or domains within our environment, or simply go and click Next. Now, under the Bulk email threshold, by default, this is set to 7. But if we drop it lower to, let's say 1, that simply means that we'll be receiving messages mainly from ads that we may have signed up or newsletters that we've signed up to, et cetera. But that may also negate the coming in of any traffic that could also be legitimate. So for us to be able to maneuver and make sure that we are in a safe place, we could actually work with what Microsoft recommends being on 7.

2:47But if we really think we are missing out on some information that we're previously able to access, then we could set it up to 8. However, this is not recommended. So 1 is the best. 7 is what is default and recommended. And 9 is the worst. But what if we really want to go as low as possible and at the same time, be able to allow certain types of traffic? Well, there is an option for that. All we could do is to drop this all the way down, maybe to 2 or 3 or depending on what exactly we want. And then look at the various options provided under the increased spam score.

3:17What is happening in this area is that you're going to allow certain areas, such as image links to remote websites, to have a higher score, and thereby allowing the traffic to make its way to your mailbox. So we can go ahead and say image links to remote websites. Yes, we want that. Numeric IP addresses, not really, so keep it on off. URL to another port-- that actually sounds a little bit dubious. So you might actually just want to keep it off. But we might also want to have information that is linking us to a dot biz or a dot info website, which is really cool to have, but not to show whether that will work for or against us.

3:52So just go ahead and put it on Test and see how things would turn out. And then we have the kind of messages that we may want to be marked as spam within an environment. So if a message simply comes in and it's empty, yes, you can mark that as spam. If there is some form of embedded tags that are in HTML, yes, you can mark that as spam. And these would simply help us to customize and well-design our spam policy in such a way that it's able to capture features that are actually regarded as spam within our environment. So we can go ahead and figure out all these areas and make sure that we have the rightful selections that would protect our users.

4:26We have options such as a message containing a particular language. So we can simply go ahead and say yes. And maybe that language is, let's say, Belarusian. We'll go ahead and specify that over there. And you have from these countries. You can specify what countries you'd like to have in that area. And they simply match your spam policy more effective in protecting the various users that you have in your environment. And finally, you can decide to receive an email for all those options that you may have selected to be in Test mode. So over here, we can simply go ahead and say, all right, we would like Alex to be receiving all those emails.

4:57And then we can go ahead and click Next. Now, you'd realize that over here, we have the various actions that you may simply want to see for each and every matched policy. So in the event that we receive a spam message, we can decide what this policy should actually do. So we can choose to move the message to a junk email folder, which is actually good practice because once it's moved to junk, in about 30 days, Microsoft will flush it out from there. So we can actually keep that ease. But if we want to be able to maybe redirect that particular message or delete the message, these are options that are also provided over here.

5:29We have High confidence spam. This simply means that the kind of message that you received as spam is highly rated as being spam. So it's that kind of messages. The best practice would be for us to go ahead and just delete them. And then we have phishing messages that we may simply want to also delete. And if we decide to quarantine them within our environment, then we simply have to go and choose one of our quarantine policies. The best practice is for us to go and choose an administrator who will look into those messages while they're in quarantine. We have High confidence phishing, which can also configure over there, and multiple other options that we can actually work with to make sure that we are secure.

6:02Now, when it comes to granting of those spam messages, we can decide for how long we'd like to retain them. Now, by default, this is set to 15. If you want to retain them for a longer period, we can always increase that or decrease, as desired. The Safety tips area is very important. And if you encounter any of these deselected like these and show that these are enabled, as this is what allows your users to receive banner messages that are keeping them of how vulnerable they could be by accessing that particular message. If messages are rated as being spam, then a safety tip is one of those layers of security you'd need to inform a user to act wisely.

6:37From here, we can go ahead and click Next. And here, we have the Allow and block list. So if you want to be allowing certain users within our environment, you can go ahead and add them over here. If we want to block those users, it's the same thing over here. So we can also do the same for the various domains and users that would like to allow or block within our environment. Now, depending with the approach that you would want to have in your environment and using your threat intelligence sources, you could actually be able to pick up certain domains and add them over here under your Blocked list. But under Senders, let's see if I can block a sender.

7:08I'll just go ahead and add my sender over here as Cameroon. Click Add sender's. Done. And then you can click Next. So this is the policy that we have now created. Let's see if when we try to send an email using Cameroon's email address and verify whether that email is going to go through, or be thwarted by this particular policy. So go ahead and click Done over here. And there is our policy. So let's go ahead and open Cameroon's mailbox. So let us test this out. I've got a user over here by the name of Megan.

7:39And Megan is part of my Sales groups. So those groups that I added earlier actually contain a user by the name of Megan. So if we go and try to send Megan an email from here, let's just try this out, let's say this is going to be a new email, and it's going to be directed to Megan Bowen. There we go. So let's say this is going to be spam. And then we can just also say in the message area over there as spam. And if we send this out, our expectation is that this message will not go through.

8:12So we've tried to send that out. Just quickly minimize that. And try to go to a legitimate email address. We can see here, there isn't anything brought in. Let's see what happens if we send a legitimate email to Megan. So just expand that as well. New email. And then we can say we're looking for Megan. And then we just say basic hello. So let's see if this is going to go through. Send that. And then you minimize it. Let's wait within-- and there we go.

8:43So this particular message from administrator does come through. But the other message that is coming from the spam message, does it actually find its way through? And this is how we can leverage the anti-spam policies to prevent messages that are malicious, making their way into our mailboxes. For now, my friend, I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] Hello, and thank you for joining me in this Nugget as we configure and manage anti-malware policies. So it is great practice for us to be able to configure various Microsoft 365 solutions that will provide layers and layers of security to various resources and data that we have in our environment. But for us to be able to have anti-malware policies, we have to go and access the security area. And this will bring us into the Microsoft 365 Defender area, where we can actually access the various policies and rules.

0:34Now, once we are in here, we can access Threat policies. And from Threat policies, we have Anti-malware. So by clicking on that area, you'd realize that we have the area where we're able to see the various existing policies. And we can also create our own policies. But before we can go ahead and create our own policies, there are preset policies that actually exist in this area. And it's important, very important that you go and look at those and figure out whether they are enabled for environment. So just access them from the recommendation notification over here by clicking on Preset security policies.

1:05And this opens this Preset security policies area, where we have built-in policies. You'd realize that this is what is contained within those built-in policies. And if you wanted to exclude certain users from actually participating in that, you could go and add them over here. We also have the standard protection. And this can actually configure. And this is what is actually covered, features which is balanced action for malicious content, balanced handling of bulk content, et cetera. This can actually protect you from various orchestration and spamming that may actually happen in your mailboxes.

1:36You also have strict protection, which you can also implement. This is a version that is more aggressive in terms of how it controls malicious mail, the various management of bulk emails that are being sent within your environment, and many other machine learning tools that would actually enable you to be more secure than you would be with standard configurations. So let's quickly go ahead and look at the standard protection. We go ahead and click Manage protection settings. This area brings us into this particular window, where we're able to define the various users we would like to participate in this policy.

2:08So let's assume that this is meant for all users. We just set it to all recipients within our environment. If we wanted to exclude certain users, like administrators, in case this is just a pilot test, then you can go ahead and select them over there. Then you can go ahead and click Next. And over here, we can look at the various users where we can actually apply Defender for Office 365. And this is really important in making sure that Defender for Office 365 is simply implemented so that our users can be protected from the malicious types of malware that may come through Office 365.

2:40And if you want to apply this again to a specific group of users or recipients, we can still go ahead and make use of these options over there. And thereafter, we can click Next. And this brings us into the Impersonation protection area. Now, this is really a very important area in making sure that if an attacker has crafted some form of emails so as to impersonate the executives within your environment, you would be proactively having some form of policy within your environment that actually thought such kind of actions. And this is what impersonation policy simply looks for. So down here, we can always be looking for the various users that we do not want to see being impersonated.

3:14For example, if Allan is our finance manager, we can simply go and say Allan over there. And then go ahead and look for their email address. Having them added over there simply allows us to protect this particular user against these kind of attacks. Once that has been set, we can go ahead and click Next. And this brings us into the domains to flag when impersonated by attackers. Now, these could be our own domains or the domains of the various stakeholders or partners that you trade with that you may simply want to add over here, such that in the event that there is some form of impersonation that has happened, the messages that has actually come with that particular domain could be quarantined and thereby protecting the intended target.

3:51Let us look at the following section. Now, here we have all trusted email addresses and domains that you may want to have. So over here, we can simply add our own domain. We can also add the domains of our trade partners and various stakeholders, et cetera. Then you can click Next. In this area, we simply want to decide whether this particular policy should be turned off, or whether we should leave it on upon completion, or leave it as is. Go and click Next. And this gives us an opportunity to quickly preview this particular policy. Now, this becomes very important in securing the various areas, such as Office 365 impersonation, and other things that we may actually overlook as we consider what areas to protect within our environment.

4:29So click Done. And once that is done, we can head back to our rules and policies from where we can actually configure the desired anti-malware policy. So here, we have our standard preset security policy. Let's go ahead and create a new one. And this is going to be, let's say for the Sales department. We can give a description over here as to how this is protecting the people within that particular department. We go ahead and click Next. And here, we can specify the users or the groups that we simply want to see participating in this particular policy. So this is going to be Sales team.

5:01And then it's also going to add the Sales group. There we go. And once we've added those groups, you can always go in add domains or exclude users, groups, and domains. Let's go ahead and click Next. In here, you'd realize that we have various protection settings. And what you're seeing here are various types of formats which are identified as malware. Now, if you're going to be having any file that is an attachment that comes to your mailbox and carries any of these formats, then that file will not make it. It's important, therefore, to make sure that you exclude that particular format from this list.

5:32For example, you might have anything that is in scr. So you might just want to remove that. And if you have anything that is in dot vb or maybe dot z, you can go ahead and remove that. Otherwise, Microsoft will also thwart all those types of formats. If you have additional format types that you'd like to add in here, you can always go over there. Type it and add it over there. Now, this becomes very handy in making sure that it actually follows each and every attachment that comes through our environment. And if there is anything that has an executable potential, then that could actually be stopped from being executed within our environment.

6:06So assuming that an email was sent to your mailbox that had a dot cmd attachment, that particular email itself will not make it to your inbox. And what Microsoft does is that it will simply reject the delivery of that email and send an NDR or a Non-delivery Receipt to the sender. So the sender will be notified to say, hey, you know what, this user does not accept this format of attachments. And then the sender would decide whether they would send something differently, or it would just be a losing battle, or you can decide to quarantine. Now, this is not very recommendable because that message will make it to your environment.

6:39It will make it to your mailbox. And if we have a user who is not well-informed, they may end up tinkering with that message and executing any file that may actually become very malicious to the rest of us within our environment. So it's always best to leave it on Reject messages with an NDR sent to the sender. Then we have Enable zero-hour auto purge for malware, which is just a method to quarantine any message that may have been missed. So if there is any message that found itself into our mailbox, this option over here would go over there and collect those emails and quarantine them.

7:11And once they are in quarantine, we can then decide who should have access to that. It's always important to make sure that only administrators have access to those particular folders. The rest of this section, in terms of configuration, focuses on notification. How do we want our various stakeholders, especially from a security perspective, to be informed whenever there is anything that actually aligns with this policy? So we might look at notifying an administrator about undelivered message from internal senders or even undelivered message from external senders so that each and every time there is any message that is pending in the environment, those administrators are notified, and they can take action.

7:50So all we need to do is to specify the email addresses of those administrators over there. And once that is done, we can go ahead and click Next. And then we can review this particular policy and submit it. Now, anti-malware policies are very important. They are not a substitute for anti-viruses. But when combined with all different types of security solutions that we provided within our environment, we definitely can end up with a formidable environment. For now, my friend, I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] After COVID, we no longer have to overemphasize on the importance of quarantine. Hello, and welcome. In this Nugget, we're going to look at how we can go about configuring quarantine policies. So quarantine policies are security policies that are designed to isolate and contain potentially malicious or suspicious files and messages that may traverse our network. And by use of Microsoft 365 Defender and Advanced Threat Protection, we can craft the best quarantine policies that would help protect the various areas of our tenant.

0:35For example, you could be interested in looking at our Exchange area, looking at the various mailboxes, and how we can simply protect our users from harm that may come as a result of maybe user clicking on a link or an attachment that may lead to the compromise of various resources that we have in our environment. We could also look at the various endpoints that we have within our environment and configure them in such a way that if there is a file that is a corrupt file that is actually accessing an endpoint, that particular endpoint should actually be isolated. So the file that is contained within that particular endpoint does not end up being transmitted to other devices that we have in our environment.

1:11And finally, cloud applications. Cloud applications could also be secured. And we can have some quarantine policies in place that would make sure that each and every time a cloud application accesses a file in the event that particular file is actually compromised or it's corrupt, then we can also lock that particular application and remediate that incident from the confinement of that application. So all this happens with the help of these tools over here. And we can let our own set up various alerts that could be sent to our administrators, notifying them of the various changes, or even certain things that would help them to proactively resolve issues within our tenant.

1:49Well, without further ado, let's dive into Microsoft 365 and look at how we can configure our quarantine policies. So we're back in our Microsoft 365 Defender area. And if you go to Email collaboration, right under that, you have Policies and rules. You should be able to access this section over here. Now, if you scroll all the way down, you have quarantine policies. We'll click on that, and in here, we have some default quarantine policies that Microsoft has already designed for us. But we can go ahead and create our own custom policies. So these are the ones that are here by default.

2:19Let's go and click Add custom policy over here. And this simply allows us to begin crafting our quarantine policies. So this is going to be for our sales department. So this is going to be Sales-Q, for example. We can go ahead and click Next. And here, we have the various message access definitions. Now, if you look closely, we have the limited access. And this seems to be what Microsoft recommends because over here, users are not really having the power to be able to access a quarantine message, or maybe even delete, or release it, et cetera.

2:49So this simply keeps your team very safe. But if you think this is not enough, your team provided have been trained in information security and there is some form of awareness and the ability for them to be able to identify what is likely to be dangerous and malicious within that environment, then you can look at these advanced features. Now, if we go ahead select Set specific access, we then can decide what our users must be able to perform. So under Release action preference, for example, we can simply go and say Allow recipients to request a message be released, or Allow recipients to release a message from quarantine.

3:22Now, this would mean we're going really far in terms of giving these users the privilege to be able to interact and play around with those quarantine messages, which are potentially harmful for environment. So I would simply say let us give them the privilege to request each and every time they've got a message, which they think should actually be given or handed over to them. Then we can look into it prior to them having access to that. And further than that, we can decide whether these users should be able to delete those messages, preview, or even block the sender once they have an access to those messages or files.

3:55However, the safest zones to remain in the Limited access over there. Now, let's go ahead and click Next. In this area, we can decide whether we'd like to have some quarantine notifications. Yes, we would like to. And once we have that set up, we can go and click Next. We can do a quick preview of what we've configured and submit that particular quarantine policy. So these are very important in ensuring that we have the desired policies set in place and that they accurately reflect what we'd like to see happening with the various users that we have within the environment as far as the quarantining of files and messages is concerned.

4:29So there we have our policy over here. And if we select it and go to Global settings, this is where we then be able to configure the various information types that have to do with the sender of the quarantine message. For example, over here, we have to specify the quarantine name. So let's say the sender is going to be Allan. And then here, we have to specify the email address. Let's just search for Allan over here. That's Allan Deyoung. And then we can say the subject is going to be message has been quarantined. And then we can add the information that is relevant. Default language, you can set that to English, and many of the information types that you may simply want to have in this area, such your company logo, if you'd like to note that, and how often you would like to see the messages being sent out.

5:09Is it every 4 hours or daily or weekly? Now, the frequency here is very important because if we make them too long, again, it becomes a challenge for this person to be well-informed in time as what exactly could actually be happening within that particular environment. So let's go ahead over here and click on Save. And with that in place, we can then anticipate each and every user, who happens to have a message in quarantine, to actually receive this within their environment. Well, this is how we can make use of quarantine policies to inform various users that we have within our environment.

5:39And for now, I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] Hello, and thank you for joining me in this Nugget as we look at how we can go about configuring safe attachments within our tenant. So we just looked at how we can create quarantine policies within our environment. But attackers use different means and ways to try and compromise our environments. And thereby, it's very important for us to make use of the various solutions that are available to protect our users and the resources that we have within the environment. So let us go ahead and look at how we can configure safe attachments.

0:31This is ideal for securing information that come in form of attachments, as well as for our SharePoint sites that may be used to share various types of files. So in here, we go ahead and create our attachment policy. And again, this is going to be for our Sales department. We can always have a description over there. We'll go ahead and click Next. And we'll point these to the various groups that we have within an environment. So add our Sales group as well as the Sales team. Now, once we have done that in place, as usual, we can always add various domains, as well as exclude certain users within our environment.

1:06But if everything over here has been configured, the work remains to be done under the Settings area. Now, it's in the Settings area where we can determine what should be happening, the various types of files that come as attachments within our environment. So if you scroll down, you'd realize we have different options that are provided over here. And if any email is sent to us with an attachment that actually contains malware, then we have to decide what has to happen over here. For instance, if we turn this to off, it simply means that particular email will make its way into our mailbox without being scanned at all.

1:37Then we also have Monitor. This simply allows us to be able to deliver the message if malware is detected and check scanning results. However, this may not be the best option as this allows that email to make its way into a mailbox, whose owner may end up opening the particular attachment. We also have the ability to block that particular message and prevent that particular attachment from making its way into our environment. Now, the Dynamic Delivery option allows us to receive the text part of that particular message, but it retains the attachment until the scan has actually been done and proven that the attachment itself is not harmful.

2:10So this may become very handy, just to be able to give the information that is relevant to the recipient. And later on, if the attachment doesn't contain any malicious contents, then that attachment can also be sent to that recipient. Under Quarantine options, we can use the default options. But we also have the ability to add our quarantine policy that we customized. So over here, we can simply go ahead and select the Sales quarantine option, which would ensure that quarantine settings that we applied in this particular quarantine policy would apply to this policy over here, meaning that if a user happens to receive an email that has an attachment and that attachment has contents that are not proven to be safe, the user will be provided with an opportunity to look into the quarantine folder and be able to block the sender, or even be able to delete that particular message from the quarantine folder.

2:55And if we're making use of the Monitoring mode, we could also enable redirection, which allows us to send an attachment that is proven to be malicious within the environment to a particular email address. This could be the administrators, email address, or maybe somebody in the security department who would then be able to look into that and resolve such kind of issues. But with this configuration, you can go ahead and click Next over here. This is just providing us a preview of that safe attachment configuration. And then we can submit to enable that policy. And there's our policy. We can select it and carry out various activities that pertain to that particular policy.

3:29But before, we can just conclude that two important things that actually happen in this area. The very first one is the Global settings area. This is to ensure that we have the rightful features enabled, such as turning on Microsoft Defender for Office 365 to protect information in our OneDrive, or SharePoint, Microsoft Teams, et cetera. So you need to make sure that that is toggled over there. The other part is the turning on of Safe Documents for Office clients. What this simply does is that if a user is opening a file, let us say an Outlook or whatever application that it is in Office, that file goes through some real-time scanning.

4:01And if the file itself is not malicious in any way, then it goes over and opens for the end user to be able to access it. But if it so happens that the file contains some malicious files or anything that actually makes it to be deemed as unsafe, that file not open. It will have to go through some additional analysis, et cetera. Now, this is currently available only in Microsoft 365 E5 license as well as the Microsoft 365 E3 Security license. So that is something to think about as you are configuring these policies within the environment and showing that all the users that you intend to participate in this particular policy have the rightful licenses.

4:34Now, these ties strongly into Advanced Threat Protection within Microsoft 365 ecosystem. And if you pull up our partial over here and access our Exchange Online, let us try to see whether these would also mirror the changes that we currently have within our environment. We can see that we have these enabled over here. So if we're going to partial and type Get Advanced Threat Protection Policy, that is going to be for Office 365. And then press Enter over here. You'd actually be able to tell whether those policies are enabled.

5:06For example, if we look closely, we will notice that we have enabled Safe Documents over there. And you can see that that is currently enabled. That's true. Of which it's also true for this particular configuration over here. But then just slightly below there, we can see that there is an option to allow people to click through Protected View whenever they're accessing Safe Documents, which simply means there could be a file that is maybe malicious. But we give the users the ability to be able to go through those kind of files. We can also look that up and see whether it's also enabled over here. So if we just try to, let's say filter through that and look for the rightful format, that is going to be SafeDocs.

5:44Then we can close that and press Enter. You'd realize that that is currently not enabled. AllowSafeDocsOpen is false. But if you enable that feature over here and click on Save, we should actually be able to verify whether it has also been enabled within our PowerShell environment. So if we press N over there, you'd realize that those features are all enabled. And we can leverage these tools, both in PowerShell, as well as in Microsoft 365, to make sure that we have the rightful configurations for our users, and that we have the rightful protection levels that will prevent our users from falling prey to the various malicious attacks that may actually exist within our environment.

6:22And for best security practices, it is not advisable for us to have that option over here set to true. So we'll go ahead and set it back to Disabled and click on Save. And then we can just quickly go ahead and close that. The final thing to look at when working with safe attachments are the reports that Microsoft provides. Over here, we can gain visibility into the status of our threat protection and just be able to tell what exactly is trending, what things we should be paying more attention to, et cetera. Quite all right, there isn't much at this particular point, but this is the location, which would actually use to have a greater understanding into the various strains of our security posture.

7:00And by looking at the various filters provided over here, we can have visibility into detection technologies. We can look into policy types, delivery actions, et cetera. For example, over here under Detections, we can see the kind of detections that have been employed for this particular user over here. So it is the employment of these solutions, coupled with others that are provided by Microsoft, that actually makes our environment more and more secure. And this, my friend, is how we can work with the safe attachment policies within Microsoft 365. For now, I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] So let us conclude by looking at how we can configure safe links within our tenant. Now, safe links are a Microsoft 365 Defender solution for combating different types of attacks that may come through various communication channels, such as your teams, as well your mailbox. So the whole idea is for us to be able to protect the various users that we have in our environment in such a way that when they receive a link, that particular link is simply scanned in real time using Microsoft solutions, and compared against a database of various links that have in the past been known to have been malicious.

0:40So here's how it works. When you receive an email containing a URL, safe links replaces the original URL with a Microsoft-generated URL. And this process is known as URL rewriting. This simply ensures that we would have a form of URL redirection, whereby when you click on that link, instead of us directly having access to it, it will be redirected to Microsoft servers for analysis and scanning prior to us being given access to the content of that particular URL. And once the URL is passed on to Microsoft servers and with the help of Microsoft 365 Defender, the URL would go through scanning an analysis, comparing it to a list of harmful URLs that are listed in the database.

1:19And other than that, Microsoft will also employ dynamic analysis. This simply allows that particular URL to launch and execute under a very controlled environment, and then observe its behavior and assess its potential threat. This dynamic analysis helps in detecting new and evolving threats that may have not been previously identified within the environment. It is only after the analysis that Microsoft would then be able to provide results based on the scanning. Now, if the link itself has been deemed to be safe and appropriate, safe links will proceed and give the user access to the website without any interruption.

1:54However, if the link is suspicious and malicious, activity has been identified with that particular URL, then safe links would block access and display a warning sign to the user, and thereby protecting the user from being exploited. Let's take a quick look at how we could configure safe links within our tenant. So here we are under Threat policies, still in Microsoft 365 Defender. If we scroll down all the way, we have safe links over here. And this simply allows us to begin the process of creating our own safe links policy. So if we click on Create, we can go ahead and say this is going to be safe links for Sales department.

2:28And then we can give a short description over there and click Next. And here, we can go ahead and add the various sales groups or the relevant parties that should actually participate in this particular policy. And with that in place, we then can go and click Next. Now, it is in this area that we can create our safe links policies for emails, for our Teams channel, Office 365 applications, and the various protection settings that you may simply want to see taking place in this particular tenant. So if you scroll upwards and go to Email, we have the turning-on button. This simply allows us to be able to implement safe links for the various URLs that we have in our environment.

3:02And here, we can apply safe links to email messages sent within our organization. Yes, it is important that we also enable this, as malicious attacks can potentially arise from within our organization. We can also apply real-time URL scanning. This might also just maybe take a bit of resources and time to actually execute. However, it's very important in making sure that each and every time there is a link that is pointing to a file, or a link that is pointing to an external site, that particular link is scanned in real time. Then we have Wait for URL scanning to complete, or Do not rewrite URLs if you're worried about speed and quick-access resources.

3:36This could be something that you have to decide upon. But for safety purposes, it is worth it to wait until a scan is completed before the message is delivered. And then you have the option Do not rewrite URLs do checks via Safe Links API only. Now, if your organization has some kind of functionalities our configurations that require you not to interact with the redirection of URLs to other servers, just Microsoft servers in this case, you may opt to use this option over here, whereby links are not redirected or rewritten. And you simply maintain the original of the link that you've received within your mailbox.

4:08And this could be very convenient if that regulatory feature is something that you may want to have within your environment. We can also apply safe links to our Team's communication, as well as the Office 365 applications. And we can track user links. If we want to have visibility into each and every time a user has accessed a URL, then it can do so by enabling this feature, which allows us to see each time a user clicks on the original URL. And click Next over here. This simply looks at notifications. And then we can do a quick review of our safe links configuration and click on Submit.

4:39So that, my friend, is how we can add an additional layer of security to our environment and protect our users against attacks, such as phishing attacks, malware infections, and other types of cyber threats. For now, I hope this has been informative for you, and I would like to thank you for viewing.