Need to Know podcast–Episode 183

I’m joined by Gabe Long from Microsoft to look at Microsoft 365 Business in depth. Gabe has been involved with the Microsoft 365 Business product since its launch and shares with use all the great new stuff that has been added since April. Of course there is news and updates from myself and Brenton bringing you up to date with the latest from the Microsoft Cloud.

Take a listen and let us know what you think –

You can listen directly to this episode at:

Subscribe via iTunes at:

The podcast is also available on Stitcher at:

Don’t forget to give the show a rating as well as send us any feedback or suggestions you may have for the show.


Gabe Long



CIAOPS Patron program

Upcoming CIAOPS classroom training

Microsoft acquires GitHub

Windows switch to GitHub

Enhanced User Experience for Office 365 Advanced Threat Protection

Office 365 Advanced Threat Protection

What’s new and what’s next with Windows Autopilot

Modernize your SharePoint team sites by connecting them to new Office 365 Groups

Share your mobile screen in Teams meeting

Introducing list sharing in Microsoft To Do

Standard SSD disks for Azure VMs

3 reasons why Azure’s infrastructure is secure

Storage Explorer in Azure portal

Configuring an Office 365 SPAM filtering policy

A common complaint I hear about Office 365 from IT Professionals is that it doesn’t filter spam as well as other third party solutions. My immediate question at that point is always “Well, have you actually gone in and configured ANY of the spam settings in Office 365 to improve your results?” to which the answer is always No. Thus, if you don’t take the time to customise what you get out of the box you’ll only get an out of the box solution which is probably not what you want! Thus, some configuration is required for EVERY Office 365 tenant to improve its spam filtering abilities.

The out of the box spam settings for Office 365 are not configured in an aggressive manner and you should go in and make changes from the defaults I would suggest. Here’s how to do that.


You’ll firstly need to login to the Office 365 portal as an administrator with rights to make changes. You’ll need to then navigate to the Office 365 Admin Center and select from the Admin centers on menu on the left hand side. You’ll find the Admin centers option right at the bottom.

From the list of options that now appear select Exchange as shown above.


This will take you to the Exchange Admin center as shown above. In here select the protection option on the left and then spam filter on the right.

You will then typically see a single policy called Default.


With this default policy selected, press the edit button (pencil) from the menu to view what settings this default policy has.


Select the different menu options on the left to view all the settings. Most you will see, like in the advanced settings shown above, are set to off.

You can of course edit this default policy, however it is better practice to go back to the list of policies and create a new one and leave the default one in place.


When you create a new policy using the plus button (+) a new dialog will appear like show above.

Give the new policy a name and now scroll through the settings to configure them for your needs.






When you reach the advanced options towards the bottom you’ll see a number of options that can set on or off. The crowd sourced results I obtained for these were:

Image links to remote sites = OFF

Numeric IP addresses = ON

URL redirect to other port = ON

URL to .biz or .info websites = ON

Empty messages = ON

Javascript or VBScript in HTML = ON

Frame or iFrame tags in HTML = ON

Object tags in HTML = ON

Embed tags in HTML = ON

Form tags in HTML = ON

Web bugs in HTML = ON

Apply sensitive word list = ON

SPF record hard fail = ON

Conditional sender ID hard fail = ON

NDR backscatter = ON


You can then set whether the policy will simply run in test mode if you wish.


The final option is to determine where this policy will apply. Normally you want this across all your domains and users but as you see, you can have different policies for different users and domains if you wish.

All you now need to do is save the policy and start monitoring the results.

Hopefully, you can now see that out of the box Office 365 does take a very relaxed approached to spam which is not uncommon for most spam protection products. You can, and should, of course go in and configure the available options to be more restrictive. When you do this you will of course get much better results.

This post showed you how to make spam filter setting via the web interface, a much better and more consistent approach across many tenants is to do this using PowerShell. Look out for an upcoming article on this.

SPAM filtering in Office 365–Best practice results

Recently, I asked people to vote on the settings in Office 365 Spam protection they believe should be made active to improve protection. That survey will continue to run and you can add your voice here:

However, with just over 30 votes as I write this I think we can draw some indications of what the best practice options are going to be.

So let’s start with the ones that should be definitely turned on based on a majority of votes for that condition:

URL direction to another port = ON


Backscatter = ON


SPF Hard fail = ON


Scripts in HTML = ON


Numeric IP addresses in URL = ON


Apply sensitive words list = ON


Empty Messages = ON


Web Bugs = ON


Condition Sender hard fail = ON


Form Tags in HTML = ON


Frame or iFrame tags in HTML = ON


Embed Tags in HTML = ON


Next, the one’s that should be off are:

Image links in Remote Site = OFF


Lastly, border line results that you probably want to set on if you want aggressive anti spam or off if you want relaxed.

Object tags in HTML = ?


URL to .INFO or .BIZ sites = ?


I’ll leave the survey running and you can check the results at any time in the future here.

In upcoming post I’ll show you how to set these options inside Office 365. However, thanks to the wisdom of the crowd (thanks to all who voted) we have an idea of what the settings should be.

SPAM filtering Office 365–Help shape a best practice


I hear a lot of people say that they don’t find Office 365 anti-spam filtering as good as other providers. My reply to that is – “Have you ever actually gone in and configured the settings from what is there by default?”. Unsurprisingly, the answer is always No.

The out of the box spam settings you get with Office 365 are designed for the “average” and probably configured for the least business interruption (i.e. less aggressive classification of what is spam). Thus, to get the optimal level of filtering you desire, it is recommended that you go and set the options the way that you want.

I have configured my tenant for the way I wish to handle spam but that is probably not exactly the best place for people to start. So with that in mind I thought that I’d call on the power of the crowd and offer up a survey were people can nominate what they consider to be major indicators of spam, based on the policy options that Microsoft provide. You’ll find that survey here:

which I encourage you to fill out and share with everyone else.

The idea is that once the results are in I report back on an overall “best practices” starting policy that the majority would feel comfortable with. I can then also show you how to exactly configure that in Office 365.

So please take a moment to complete the survey and share you expertise and thought on the ‘best practice’ approach of configure anti-spam policies in Office 365.

You can find the details on the specific advanced spam filtering options in Office 365 here:

CIAOPS Need to Know Azure Webinar–June 2018


This month I’ll take a look at the different VPN options you have in Azure and how you configure these. There’ll also be news, updates and Q and A. I hope to see you there.

June Azure Webinar Registrations

The details are:

CIAOPS Need to Know Azure Webinar – June 2018
Thursday 28th of June 2017
2pm – 3pm Sydney Time

All sessions are recorded and posted to the CIAOPS Academy.

There of course will also be open Q and A so make sure you bring your questions for me and I’ll do my best to answer them.

The CIAOPS Need to Know Webinars are free to attend but if you want to receive the recording of the session you need to sign up as a CIAOPS patron which you can do here:

or purchase them individually at:

Also feel free at any stage to email me directly via with your webinar topic suggestions.

I’d also appreciate you sharing information about this webinar with anyone you feel may benefit from the session.

CIAOPS Need to Know Office 365 Webinar–June


For June, I’m going to help you understand which Office 365 collaboration service you should use when. I’m going to give you a framework that you can apply across just about any organisation to help you make the most of services like Teams, SharePoint, OneDrive, Yammer and so on. I’ll also bring you up to date with everything happening in the Microsoft and Office 365 space as always.

You can register for free at:

June Webinar Registrations

The details are:

CIAOPS Need to Know Webinar – June 2018
Thursday 28th of June 2018
11am – 12am Sydney Time

All sessions are recorded and posted to the CIAOPS Academy.

There of course will also be open Q and A so make sure you bring your questions for me and I’ll do my best to answer them.

The CIAOPS Need to Know Webinars are free to attend but if you want to receive the recording of the session you need to sign up as a CIAOPS patron which you can do here:

or purchase them individually at:

Also feel free at any stage to email me directly via with your webinar topic suggestions.

I’d also appreciate you sharing information about this webinar with anyone you feel may benefit from the session.

New CIAOPS classroom training


I am pleased to announce the first CIAOPS hosted classroom training event.

How to migrate your SMB business to the Microsoft Cloud

Are you puzzled by the best approach to use when migrating a business to Microsoft 365 and Azure? Are you unsure of which services to use and when? Are you unsure how to cost cloud solutions? These and all your Microsoft cloud questions will be answered in this full day, face to face hands on training session. You’ll not only learn what products like Microsoft 365 and Azure are, you’ll learn how to effectively price solutions as well as frameworks that you can apply repeatedly to bring you success with migration, adoption and support. Best of all, you’ll see all the products in action via live demos.

This course is limited to 25 attendees, so hurry to secure your spot today!

Date = Thursday July 19th, 2018
Time = 9am – 5pm
Location = Cliftons Sydney, 60 Margaret St Sydney NSW 2000


Gold Patron = $149 inc
Silver Patron = $199 inc
Bronze Patron = $299 inc
Non Patron = $399 inc

More information about the CIAOPS Patron program can be found at

At the successful completion of this event it is planned to run this course at venues around Australia. To register your interest for a particular location please visit this link.

More information about the course and registration can be found here:

I hope to see you there.

Searching the Office 365 activity log for failed logins


Inside the Office 365 Security & Compliance center, under the Search & investigation menu option on the left you’ll find Audit log search as shown above.

To run a search simply provide a start and end date and select the Search button at the bottom of the screen. You can refine your search by selecting a list of different activities if you want but here we’ll leave the option set to Show results for all activities.

Once the search results are returned you’ll see lots and lots of items as shown above.


If you now select the Filter results button in the top right, each column will now display a box at the top that you can enter text into.


You can now go into the column headers and enter further filtering information. Here I have added the text ‘fail’ to the Activity column as shown. This produces two results for failed user logins.

Adding a filter now only shows the matches on the page.


You can also export the data into CSV file by selecting the Export results button next to the filter button.

You can either download everything in the audit logs (Download all results) or just your search query (Save loaded results). Here I have select the Save loaded results option.


This will then download a CSV file that you can open in Excel and will look like the above.


To make these easier to read you should convert the out to a table from the Insert tab and then select the Table icon.


Now that you have a table go to the top row of the Operations column and select the arrow to the right of this as shown. This will display the above menu. Uncheck the Select all option at the top of the list in the lower portion of the displayed dialog box.


Scroll down this same list and locate the UserLoginFailed option and select it.

This will now basically filter the whole tables of entries to only display those that have a match is UserLoginFailed in the operations column.


Which is exactly the result that you see obtained above and the same results we received from the console.

Thus, you can search the audit logs inside Office 365 directly from the portal but you can also export them to Excel to gain more power over how you wish to manipulate and report these events.