3.2.1. Email Threats with Defender for Office 365

💡 First Principle: An email threat is a set of identical or similar messages, not one message. Remediation therefore starts with scope (who received it, who clicked, what else came from the same sender or infrastructure) and ends with prevention (block the sender, URL, or file so the next wave fails).

Threat Explorer (Defender for Office 365 Plan 2; Plan 1 has the more limited real-time detections) is the hunting and remediation surface. Its views for All email, Malware, and Phish filter by sender, recipient, subject, URL, file hash, delivery action, and location. Campaign views group related messages into one campaign, showing recipients, delivery outcomes, and clicks. Advanced hunting offers the same scope with EmailEvents, EmailUrlInfo, EmailAttachmentInfo, EmailPostDeliveryEvents, and UrlClickEvents.

Remediation actions on selected messages: move to Inbox, Junk, or Deleted Items, soft delete (recoverable from Recoverable Items), or hard delete (purged). Selections of up to 100 messages get the full Take action wizard; selections of 101 to 200,000 messages offer a limited set (move or delete, or propose remediation). Analysts with the Search and Purge role (or the equivalent unified RBAC email advanced actions permission) can move or delete directly; others use propose remediation, which waits for approval in the Action center, where status and history also appear. Automated investigation on email clusters proposes actions, such as Zap email cluster, that typically need approval. Zero-hour auto purge (ZAP) works on its own, moving already-delivered messages to Junk or quarantine when Microsoft later reclassifies them as malicious.

Prevention closes the loop: add the sender, domain, URL, or file to the Tenant Allow/Block List as a block entry, and submit the message to Microsoft through Submissions to improve filtering. Then follow the user impact: UrlClickEvents shows who clicked, and those users' sign-ins and Entra ID risk show whether credentials were harvested.

Defender for Office 365 also participates in automatic attack disruption for scenarios such as business email compromise and adversary-in-the-middle phishing (2.4.3): when correlated signals show a mailbox being used for fraud, the user can be contained and sessions revoked automatically, and the incident shows the disruption tag.

⚠️ Exam Trap: "An analyst selected malicious messages in Threat Explorer, but the deletion shows as pending" means the analyst lacks the Search and Purge role, so the action awaits approval in the Action center. Granting Global Administrator is the over-privileged distractor.

Reflection Question: ZAP removed a phishing campaign from most mailboxes, but three users clicked the link before it acted. Which data sources would you check next, and which identity actions might follow?