Email filtering reports


There are some real nice and helpful email report in your Microsoft 365 Security console if you haven’t taken a look recently. You can pull them up by visiting:

as shown above. Then selecting Email & collaboration reports on the right.


The one I really like is the Mailflow status summary which you can drill into further by clicking on the heading or selecting the View details button.


If you then select the Funnel option across the top as shown, you get an idea of the number of bad emails that are being caught by each stage of the filtering process, from top (total in) to bottom (remaining out).


However, the report I love is the one you get when you select the Tech view as shown above. Why? Because this one even shows you results from DMARC as highlighted.


Many also allow you to Create schedule as shown above,


that allows you to email the reports regularly.

Keep an eye on the reporting areas of your tenant, as they are rapidly improving and expanding!

Exchange Online AV engines


I have found that many don’t appreciate that Exchange Online uses anti virus engines from multiple providers, apart from Microsoft.

“We have partnerships with multiple anti-malware technology providers, so messages are scanned with the Microsoft anti-malware engines, two added signature based engines, plus URL and file reputation scans from multiple sources. Our partners are subject to change, but EOP always uses anti-malware protection from multiple partners. You can’t choose one anti-malware engine over another.:

per – How many anti-malware partners do you have? Can I choose which malware engines we use?

So email will be scanned by three (3) engines in total. One from Microsoft and another two from third parties.

CIAOPS Need to Know Microsoft 365 Webinar – April


OneDrive for Business a pretty handy service inside Microsoft 365 that many people fail to full utilise . In this session I’ll help you better understand what OneDrive for Business is and how you can use it to improve your work productivity. I’ll also have the latest news from Microsoft and as always there will be time for your questions.

You can register for the regular monthly webinar here:

April Webinar Registrations

The details are:

CIAOPS Need to Know Webinar – April 2021
Friday 30th of April 2021
11.00am – 12.00am Sydney Time

All sessions are recorded and posted to the CIAOPS Academy.

The CIAOPS Need to Know Webinars are free to attend but if you want to receive the recording of the session you need to sign up as a CIAOPS patron which you can do here:

or purchase them individually at:

Also feel free at any stage to email me directly via with your webinar topic suggestions.

I’d also appreciate you sharing information about this webinar with anyone you feel may benefit from the session and I look forward to seeing you there.

Native external sender notifications in Exchange Online


I’ve never been a big fan of setting up rules to add a HTML banner to inbound emails, as shown above, that “warn” a user about an external email source. I dislike this solution for a number of reasons, including that it is something that an attacker can replicate, it creates a certain amount of complacency for the receiver and it ends up embedded in every reply to the email going forward.

i do however understand what is trying to be achieved here due to a lack of something provided by Exchange Online. That is, until now! A native approach is now available.



You can now get the External tag, as shown above, to appear in all versions of Outlook (desktop, web and mobile) to help understand the origin of email messages. I like this solution much better because it is built into the platform and appears in an area that an attack would find really hard to replicate. Having such labelling as a native part of Exchange Online is a much better approach I feel.



You also get the above when you view the email item.

You can enable this on new inbound messages received (only from the point you enable it going forward) using PowerShell.


You’ll need to firstly ensure that you have the latest version of the Exchange Online V2 PowerShell module. The minimum version required is 2.0.4. To verify this, and to ensure all the Microsoft 365 PowerShell modules are current in your environment, I encourage you to use my script:

that will verify and update if necessary. Just remember to run the PowerShell environment as an administrator prior to running my update script.

Now connect to Exchange Online using PowerShell. Again, you can use my script at:

to do this. In fact, using that script will also ensure that you have the latest version of the Exchange Online PowerShell V2 module installed.

Once connected to Exchange Online as an administrator running the command:

Set-externalinoutlook -enabled $true

The best documentation is currently here:

as this is still a new command at this point in time. You’ll also note that the command also has an Identity and AllowList option that you can further customise your settings.

Once the command has been run it will take a few hours for the External label to start appearing on emails from outside the organisation.

I would expect to see further configuration options become available as well as improvements to the label display. However, a very handy option that will improve the security in your environment and I’d encourage you enable it today!

Microsoft 365 connectivity testing tool


Microsoft 365 provides a handy global Network health status page you’ll find here:

You can view this page WITHOUT having to login to a tenant.


However, this same page also has some other handy diagnostics tools, for which you SHOULD login before running. I’ll share why you want to login later.

After logging to your tenant on this same page select Network Connectivity test on the left hand side or visit the direct link:


On the right hand side, all you need to do typically is select the Run test button as shown above.


This will then prompt you to download and run a small program on your desktop to assist with diagnostics. You may also find that you need to install .NET core as shown above. If so, simply follow the process to install .NET core and then run the program that was originally downloaded.


You’ll see it running around 660 individual tests as shown. Be patient, the last few take a few minutes to complete.



When complete you’ll get a nice overview report of your connectivity results as shown above. Make sure you scroll to the bottom of the window to get all the information. It is important to remember with the cloud that there many different points along a journey to and from a Microsoft 365 datacenter and not all of these are with Microsoft’s direct control. This report gives you a better idea of the latency that can occur between your location and the Microsoft datacenter where your tenant is located. When troubleshooting therefore, it is helpful to get an overall picture of the situation before focusing on where the real problem lies. This tool makes doing that much easier.


If you then select the Details tab at the top of the window as shown, you’ll get detailed connectivity information. Again, ensure you scroll right to the bottom of this page for all the details.


If you DID login to your tenant prior to running this report, the results will be saved and available under the Reports menu option on the left as shown. Every time you run a report while logged into the tenant, your report will be saved here. Very handy for historical comparisons.

Thus, the Microsoft 365 connectivity test site is a handy site to add to your toolkit. It’ll firstly let you know if there are any global connectivity issues that maybe affecting your access and, it will also allow you to run and record regular connectivity benchmarks which I think that you should do on a regard basis to get a better idea of performance to and from Microsoft 365 from your locations as well a troubleshoot connectivity issues.

Expect to see more features and capabilities rolled out here soon to you help troubleshoot connectivity issues to your Microsoft 365 tenant.