This video provides an introduction to Exchange Online Spam policies. particularly Inbound and Outbound policies plus Connect Filter Policies. You’ll see how to view the existing policies, make changes to these policies as well as create new ones using the Microsoft 365 Security Administration console.
Tag: email
Defender for Office 365 automated investigations
A while ago I wrote an article:
Improved security is a shared responsibility
in which I encouraged the use of the Report message add in to Outlook.
What you may not realise about this add-in is that not only does it provide a centralised method to manage submissions per:
Providing feedback on user reported messages
but user reported messages also trigger an automated investigation:
What alert policies trigger automated investigations?
A security administrator can also manually trigger an investigation by using the Threat Explorer per:
Example: A security administrator triggers an investigation from Threat Explorer
If you want to better understand what Automated investigation and response (AIR) is and does, have look at:
AIR in Microsoft Defender for Office 365
This triggering of an automated investigation by simply using the Report message add in is another simple way to leverage the security tools that Defender for Office 365 provides and reduce administration workload.
July Microsoft 365 Webinar resources
Slides from this month’s webinar are at:
July 2021 Microsoft 365 Need to Know Webinar
If you are not a CIAOPS patron you want to view or download a full copy of the video from the session you can do so here:
http://www.ciaopsacademy.com.au/p/need-to-know-webinars
Watch out for next month’s webinar.
CIAOPS Need to Know Microsoft 365 Webinar – July
Last months attempt at using Microsoft Teams Webinars went well and I’ll be continuing to use this going forward. Registration for this month is here:
Shortly after this you should receive an automated email from Microsoft Teams confirming your registration, including all the event details as well as a calendar invite!
This month we’ll dive into email security with Microsoft 365, particularly the best practice configurations for Exchange Online. So please join us for this and all the latest news from the Microsoft Cloud.
You can register for the regular monthly webinar here:
The details are:
CIAOPS Need to Know Webinar – July 2021
Friday 30th of July 2021
11.00am – 12.00am Sydney Time
All sessions are recorded and posted to the CIAOPS Academy.
The CIAOPS Need to Know Webinars are free to attend but if you want to receive the recording of the session you need to sign up as a CIAOPS patron which you can do here:
or purchase them individually at:
Also feel free at any stage to email me directly via director@ciaops.com with your webinar topic suggestions.
I’d also appreciate you sharing information about this webinar with anyone you feel may benefit from the session and I look forward to seeing you there.
Email filtering reports
There are some real nice and helpful email report in your Microsoft 365 Security console if you haven’t taken a look recently. You can pull them up by visiting:
https://security.microsoft.com/securityreports
as shown above. Then selecting Email & collaboration reports on the right.
The one I really like is the Mailflow status summary which you can drill into further by clicking on the heading or selecting the View details button.
If you then select the Funnel option across the top as shown, you get an idea of the number of bad emails that are being caught by each stage of the filtering process, from top (total in) to bottom (remaining out).
However, the report I love is the one you get when you select the Tech view as shown above. Why? Because this one even shows you results from DMARC as highlighted.
Many also allow you to Create schedule as shown above,
that allows you to email the reports regularly.
Keep an eye on the reporting areas of your tenant, as they are rapidly improving and expanding!
Native external sender notifications in Exchange Online
I’ve never been a big fan of setting up rules to add a HTML banner to inbound emails, as shown above, that “warn” a user about an external email source. I dislike this solution for a number of reasons, including that it is something that an attacker can replicate, it creates a certain amount of complacency for the receiver and it ends up embedded in every reply to the email going forward.
i do however understand what is trying to be achieved here due to a lack of something provided by Exchange Online. That is, until now! A native approach is now available.
You can now get the External tag, as shown above, to appear in all versions of Outlook (desktop, web and mobile) to help understand the origin of email messages. I like this solution much better because it is built into the platform and appears in an area that an attack would find really hard to replicate. Having such labelling as a native part of Exchange Online is a much better approach I feel.
You also get the above when you view the email item.
You can enable this on new inbound messages received (only from the point you enable it going forward) using PowerShell.
You’ll need to firstly ensure that you have the latest version of the Exchange Online V2 PowerShell module. The minimum version required is 2.0.4. To verify this, and to ensure all the Microsoft 365 PowerShell modules are current in your environment, I encourage you to use my script:
https://github.com/directorcia/Office365/blob/master/o365-update.ps1
that will verify and update if necessary. Just remember to run the PowerShell environment as an administrator prior to running my update script.
Now connect to Exchange Online using PowerShell. Again, you can use my script at:
https://github.com/directorcia/Office365/blob/master/o365-connect-exo.ps1
to do this. In fact, using that script will also ensure that you have the latest version of the Exchange Online PowerShell V2 module installed.
Once connected to Exchange Online as an administrator running the command:
Set-externalinoutlook -enabled $true
The best documentation is currently here:
as this is still a new command at this point in time. You’ll also note that the command also has an Identity and AllowList option that you can further customise your settings.
Once the command has been run it will take a few hours for the External label to start appearing on emails from outside the organisation.
I would expect to see further configuration options become available as well as improvements to the label display. However, a very handy option that will improve the security in your environment and I’d encourage you enable it today!
A painful bulk email sending lesson
I needed to get some event registration and Microsoft Teams meeting details out to around 100+ users recently. So, I composed the email, Bcc’d people and pressed Send as I always do.
Not longer after, I get a failed delivery to all those addresses as you can see above. The message reads:
Your message couldn’t be delivered because you weren’t recognized as a valid sender. The most common reason for this is that your email address is suspected of sending spam and it’s no longer allowed to send email. Contact your email admin for assistance.
What the hell is going on here I thought? I’ve done this before, what’s wrong?
As always, the issue has to do with the email security settings I have. One of my primary recommendations with outbound spam filtering is to limit the amount of emails that a user can send per hour and then block them once they reach this threshold.
I had, of course, gone for a very low setting because ‘I never send more than 90 email per hour’ to external recipients. We’ll guess what? The email I just tried to send crossed that threshold and now I was blocked as a user. I could no longer send ANY emails!
So that’s the why, now the how to fix it so I could again send emails?
Initially, I thought that I’d just go in and change the policy and bump up the threshold plus set the action to alert only. Surely, that’ll fix my problem, right? After retrying 5 minutes, 10 minutes, etc up to 1 hour after the change, I still had the same issue. Damm!
As it turns out, because I had contravened that outbound spam policy I’d ended up as a ‘Restricted user’, as shown above. The direct URL to this portal is:
https://security.microsoft.com/restrictedusers
I could go in there and select the Unblock link to the right of my login.
I’m take through a wizard as shown above, giving me the reason why I have been restricted and some recommendations.
Given that I already have MFA enabled and I’m happy that my password has not been compromised, I select the Unblock user button at the bottom of the page. Note, the warning at the bottom of the page here:
It may take up to 1 hour before restrictions are removed
Damm!
I receive a last warning about removing the restrictions, to which I select Yes to continue.
After waiting the 1 hour, as directed, I was back in business.
In summary, it is always the exception that catches you out. I had never before crossed the outbound threshold limits before. I must have been close, but clearly this send was above those limits and resulted in contravention of the policy. The result being that I ended up on the restricted user list, unable to send. Once I had worked out how to get myself off that list, by visiting the appropriate portal, it was easy enough to get things back in order, although the up to 1 hour wait for this removal process to complete should not be overlooked.
After this learning experience, the question is now, what should my outbound spam policy be set to? I rarely send this many emails within an hour time frame, but I may indeed need to do so in the future again at some point? Should I increase the limit from 90? Should I also change the action from restrict to just alert? All very good questions I’ll need to consider.
So the learning from this experience is, when you get a security exception, where do you look to work out why it has happened? Second, how to ‘allow’ it if the action was not an exploit? Finally, what adjustments should be taken in the policy to avoid the same instance happening again in the future. Security is not an exact science and it is exceptions that cause you the greatest pain. Sometimes that pain will be due to a false positive, but in the end, I’d rather experience that pain than a full on breach!
Email overrides are not best practice
I see a lot of email configurations in Microsoft 365 that use some form of override to ‘get around’ a delivery issue. Doing so is simply not best practice and in fact opens you up for additional attacks.
For more information, let’s review the Microsoft document:
Create safe sender lists in EOP
which says:
- We don’t recommend managing false positives by using safe sender lists, because exceptions to spam filtering can open your organization to spoofing and other attacks.
- Use Outlook safe senders – This method creates a high risk of attackers successfully delivering email to the Inbox that would otherwise be filtered; however, the user’s Safe Senders or Safe Domains lists don’t prevent malware or high confidence phishing messages from being filtered.
- Use the IP allow lists – Without additional verification like mail flow rules, email from sources in the IP Allow List skips spam filtering and sender authentication (SPF, DKIM, DMARC) checks. This creates a high risk of attackers successfully delivering email to the Inbox that would otherwise be filtered; however, the IP Allow List doesn’t prevent malware or high confidence phishing messages from being filtered.
- Use allowed sender lists or allowed domain lists – This method creates a high risk of attackers successfully delivering email to the Inbox that would otherwise be filtered; however, the allowed senders or allowed domains lists don’t prevent malware or high confidence phishing messages from being filtered. Do not use domains you own (also known as accepted domains) or popular domains (for example, microsoft.com) in allowed domain lists.
In short, if you are using white lists or the like you are creating a vulnerability in your environment that attackers can exploit. All inbound messages should be filtered through appropriately configured mail filtering policies. If you want information on setting these appropriately see:
Mail flow best practices for Exchange Online and Office 365
Best practices for configuring standalone EOP
Recommended settings for EOP and Defender for Office 365 security
To get an overall picture of all the message overrides in your environment visit the Security and Compliance admin portal:
Locate the Reports option on the left and then select Dashboard as shown, from the expanded options. Then on the right locate the Threat protection status tile as shown and select it.
From the pull down options in the top right, as shown above, select Message override.
You should now see a nice summary of any messages passing through your environment that are overriding your configurations. Don’t forget that you can also View details table and select to Filter in the top right of this report.
A direct link to this report can be found here:
Threat Protection status – Message override
Overriding policies conditions is something that should be avoided as much as possible, simply because it increases the risk in your environment. Also, if you haven’t already, go take a look at what messages are overriding in your environment today and try to eliminate these to improve your security.
CIAOPS 