Often admins with privileged accounts have broad standing access, and therefore, become lucrative targets of repeated attacks as access to admin credentials can lead to deeper access to sensitive data. Due to this risk, regulators are increasingly looking for appropriate limits on privileged access, greater oversight, and audit trails.
To help customers protect and control their sensitive data, and meet their compliance needs, today, we are announcing preview of privileged access management in Office 365.
New privileged access management capabilities in Office 365 provides an approval workflow that’s scoped to your high-risk tasks within Office 365. For example, standing admin privileges enable admins to execute tasks that can provide unfettered access to organizational data, such as a journal rule, which can copy emails to a shadow mailbox and exfiltrate sensitive data undetected.
Privileged access management in Office 365 was designed based on the principle of Zero Standing Access, which is how we run our own data centers at Microsoft through Lockbox and Customer Lockbox. With privileged access management in Office 365, access requests must be approved by an authorized set of approvers. Access is then time-bound for a limited duration — often referred to as “Just-In-Time” (JIT) access. This level of rigor is how we manage administrative access privileges internally for Office 365 today.
Requests for access can be automatically or manually approved. Either way, all the activity is logged and auditable, so that both privileged access requests and approvals can be reviewed and seamlessly provided for internal reviews and auditor requests.
Read below for more details.
Creating Access Policies
Getting started with privileged access management in Office 365 in your organization is simple. Within the Office 365 Admin Center, you can create access policies at a task level, scope it to an Office 365 workload, and to a specific task within that workload. The policies also allow for flexibility in how requests can be approved – automatically or manually through a set of designated approvers.
Graphic: Configuring a new access policy in the Office 365 Admin Center.
Enforcing an Approval Workflow
Once policies are in place, privileged access management in Office 365 will enforce the approval workflow, and when needed, users can request Just-in-Time access to execute these privileged tasks. Their privileges will endure only for the time requested and approved, vastly reducing the risk to the organization from privileged credential compromise.
Graphic: Cmdlet fails with an error and asks to raise an elevation request to get access.
Graphic: Request access using New-Elevated Access Request cmdlet, request is scoped to New-JournalRule with a limited duration of 4 hours.
Approving Access
All access requests generated through the privileged access management workflow are available to view in the Office 365 Admin center. Designated approvers can review the details of the request –the requester, requested duration, and specified reason – and can then approve or deny the request.
Graphic: As the approver, you can see the pending request with option to approve or deny request.
Audit Documentation
All activities – requests, approver actions, and subsequent tasks performed by the requesters – are logged and available for review in the Office 365 Management Activity logs. These audit logs provide a chain of events that also serve as evidence for compliance requirements.
Graphic: Review audit logs for all privileged access management activity.
Get Started Today!
Privileged access management in Office 365 is available in preview for our customers with Office 365 E5 and Advanced Compliance SKUs who register for the option. We hope you take that extra step to enable these features for advanced access control capabilities in your Office 365 tenant today. You can get started by:
- Watching the Mechanics Video on privileged access management in Office 365.
- Signing up for the preview at https://previews.office.com, with code PAM044.
- Attending the Ask Me Anything (AMA) – sign up for the event here.
We hope you like what you see – please do sign up for preview so we can get your feedback!
Frequently Asked Questions
Q: What SKUs do I need to use privileged access management in Office 365?
A: We plan to offer this capability in the Office 365 E5 or the Advanced Compliance SKU when we release to general availability.
Q: Which Office 365 services are supported with privileged access management in Office 365?
A: During this preview, privileged access management in Office 365 applies to tasks available in Exchange Online. We are working to expand privileged access management capabilities to other Office 365 workloads.
Q: How is this different from the Azure Active Directory Privileged Identity Management (AAD PIM)?
A: Azure AD Privileged Identity Management (PIM) and privileged access management (PAM) in Office 365 together provide a robust set of controls for protecting privileged access to your corporate data. With Azure AD PIM, customers can secure admin roles to ensure protection across Office 365 and Azure clouds. PAM in Office 365 can provide another granular layer of protection by controlling access to tasks within Office 365.
Q: What permissions do I need to turn this feature on?
A: You need to be a Global or Tenant administrator to be able to turn this feature on. Soon we will enable a new user Role that also will be able to perform these actions.
Q: How is privileged access management in Office 365 related to Customer Lockbox?
A: Customer Lockbox allows a level of access control for organizations around accessed to data by their service provider, i.e. Microsoft. Privileged access management in Office 365, allows granular access control within an organization for all Office 365 privileged tasks.
Often admins with privileged accounts have broad standing access, and therefore, become lucrative targets of repeated attacks as access to admin credentials can lead to deeper access to sensitive data. Due to this risk, regulators are increasingly looking for appropriate limits on privileged access, greater oversight, and audit trails.
To help customers protect and control their sensitive data, and meet their compliance needs, today, we are announcing preview of privileged access management in Office 365.
New privileged access management capabilities in Office 365 provides an approval workflow that’s scoped to your high-risk tasks within Office 365. For example, standing admin privileges enable admins to execute tasks that can provide unfettered access to organizational data, such as a journal rule, which can copy emails to a shadow mailbox and exfiltrate sensitive data undetected.
Privileged access management in Office 365 was designed based on the principle of Zero Standing Access, which is how we run our own data centers at Microsoft through Lockbox and Customer Lockbox. With privileged access management in Office 365, access requests must be approved by an authorized set of approvers. Access is then time-bound for a limited duration — often referred to as “Just-In-Time” (JIT) access. This level of rigor is how we manage administrative access privileges internally for Office 365 today.
Requests for access can be automatically or manually approved. Either way, all the activity is logged and auditable, so that both privileged access requests and approvals can be reviewed and seamlessly provided for internal reviews and auditor requests.
Read below for more details.
Creating Access Policies
Getting started with privileged access management in Office 365 in your organization is simple. Within the Office 365 Admin Center, you can create access policies at a task level, scope it to an Office 365 workload, and to a specific task within that workload. The policies also allow for flexibility in how requests can be approved – automatically or manually through a set of designated approvers.
Graphic: Configuring a new access policy in the Office 365 Admin Center.
Enforcing an Approval Workflow
Once policies are in place, privileged access management in Office 365 will enforce the approval workflow, and when needed, users can request Just-in-Time access to execute these privileged tasks. Their privileges will endure only for the time requested and approved, vastly reducing the risk to the organization from privileged credential compromise.
Graphic: Cmdlet fails with an error and asks to raise an elevation request to get access.
Graphic: Request access using New-Elevated Access Request cmdlet, request is scoped to New-JournalRule with a limited duration of 4 hours.
Approving Access
All access requests generated through the privileged access management workflow are available to view in the Office 365 Admin center. Designated approvers can review the details of the request –the requester, requested duration, and specified reason – and can then approve or deny the request.
Graphic: As the approver, you can see the pending request with option to approve or deny request.
Audit Documentation
All activities – requests, approver actions, and subsequent tasks performed by the requesters – are logged and available for review in the Office 365 Management Activity logs. These audit logs provide a chain of events that also serve as evidence for compliance requirements.
Graphic: Review audit logs for all privileged access management activity.
Get Started Today!
Privileged access management in Office 365 is available in preview for our customers with Office 365 E5 and Advanced Compliance SKUs who register for the option. We hope you take that extra step to enable these features for advanced access control capabilities in your Office 365 tenant today. You can get started by:
- Watching the Mechanics Video on privileged access management in Office 365.
- Signing up for the preview at https://previews.office.com, with code PAM044.
- Attending the Ask Me Anything (AMA) – sign up for the event here.
We hope you like what you see – please do sign up for preview so we can get your feedback!
Frequently Asked Questions
Q: What SKUs do I need to use privileged access management in Office 365?
A: We plan to offer this capability in the Office 365 E5 or the Advanced Compliance SKU when we release to general availability.
Q: Which Office 365 services are supported with privileged access management in Office 365?
A: During this preview, privileged access management in Office 365 applies to tasks available in Exchange Online. We are working to expand privileged access management capabilities to other Office 365 workloads.
Q: How is this different from the Azure Active Directory Privileged Identity Management (AAD PIM)?
A: Azure AD Privileged Identity Management (PIM) and privileged access management (PAM) in Office 365 together provide a robust set of controls for protecting privileged access to your corporate data. With Azure AD PIM, customers can secure admin roles to ensure protection across Office 365 and Azure clouds. PAM in Office 365 can provide another granular layer of protection by controlling access to tasks within Office 365.
Q: What permissions do I need to turn this feature on?
A: You need to be a Global or Tenant administrator to be able to turn this feature on. Soon we will enable a new user Role that also will be able to perform these actions.
Q: How is privileged access management in Office 365 related to Customer Lockbox?
A: Customer Lockbox allows a level of access control for organizations around accessed to data by their service provider, i.e. Microsoft. Privileged access management in Office 365, allows granular access control within an organization for all Office 365 privileged tasks.
With the kickoff of InfoSec Europe, we shared an update of our recent enhancements to Office 365 threat protection services. Today, we discuss the significant enrichment to the end user experience in Office 365. By empowering end users to make better decisions which help drive proactive protection, we offer an unique, powerful, and potentially best in class solution. The features we showcase today provide end users greater information, enabling better decision making and ultimately greater security.
Introducing Native Link Rendering
‘Native Link Rendering’ is now available for customers using Office Web Application (OWA). Soon the feature will also be available for the Outlook client. ‘Native Link Rendering’ exposes the native link for a user to view, though we still wrap the link in the back end for analysis. Importantly, no other advanced security solution can provide this powerful and crucial feature. Native Link Rendering has been a top request from customers because it supports end user education by providing visibility to the original view of an URL. Office 365 ATP’s Safe Links ‘time-of-click-protection’ protects users from clicking through to a malicious site. To do so, Safe Links wraps the link at the time of click, obfuscating the native URL which reduces users’ ability to learn what a potentially malicious URL may look like. Customers educating end users on indicators of a malicious link, require the display of native links since wrapped links prevent the ability to train users. ‘Native Link Rendering’ lets users see the original link. It is an unique and critical feature serving to empower our customer’s users to become more aware, sophisticated, and proactive at preventing themselves from being compromised by malicious links. Microsoft believes education and awareness is a foundational element for holistic security and Native Link Rendering serves to both educate and raise user awareness on cyberthreats.
Figure 1. Native Link Rendering Feature showing the original URL in the hover window
Enhanced Safe Links Warning Pages
The end user experience is further enhanced with new Safe Links warning pages. The new warning pages provide granular details on why a warning is generated. The pages range from notifying the user that a link is still being scanned, to a generic error warning.
Figure 2. Summary of New Safe Links Warning Pages
With this greater detail, users have better information on why a link was flagged, facilitating user understanding of when and why threats are blocked. Ultimately, a more informed user base can make better decisions and can better protect themselves from threats. We are excited to help your end users heighten their awareness and improve on their knowledge of potential threats.
Send Us Your Feedback
Your valuable feedback enables us to continue improving and adding features that support the goal of making Office 365 more secure. We encourage you to begin a free Office 365 E5 trial today and begin further enhancing your security for Office 365 today.
With the kickoff of InfoSec Europe, we shared an update of our recent enhancements to Office 365 threat protection services. Today, we discuss the significant enrichment to the end user experience in Office 365. By empowering end users to make better decisions which help drive proactive protection, we offer an unique, powerful, and potentially best in class solution. The features we showcase today provide end users greater information, enabling better decision making and ultimately greater security.
Introducing Native Link Rendering
‘Native Link Rendering’ is now available for customers using Office Web Application (OWA). Soon the feature will also be available for the Outlook client. ‘Native Link Rendering’ exposes the native link for a user to view, though we still wrap the link in the back end for analysis. Importantly, no other advanced security solution can provide this powerful and crucial feature. Native Link Rendering has been a top request from customers because it supports end user education by providing visibility to the original view of an URL. Office 365 ATP’s Safe Links ‘time-of-click-protection’ protects users from clicking through to a malicious site. To do so, Safe Links wraps the link at the time of click, obfuscating the native URL which reduces users’ ability to learn what a potentially malicious URL may look like. Customers educating end users on indicators of a malicious link, require the display of native links since wrapped links prevent the ability to train users. ‘Native Link Rendering’ lets users see the original link. It is an unique and critical feature serving to empower our customer’s users to become more aware, sophisticated, and proactive at preventing themselves from being compromised by malicious links. Microsoft believes education and awareness is a foundational element for holistic security and Native Link Rendering serves to both educate and raise user awareness on cyberthreats.
Figure 1. Native Link Rendering Feature showing the original URL in the hover window
Enhanced Safe Links Warning Pages
The end user experience is further enhanced with new Safe Links warning pages. The new warning pages provide granular details on why a warning is generated. The pages range from notifying the user that a link is still being scanned, to a generic error warning.
Figure 2. Summary of New Safe Links Warning Pages
With this greater detail, users have better information on why a link was flagged, facilitating user understanding of when and why threats are blocked. Ultimately, a more informed user base can make better decisions and can better protect themselves from threats. We are excited to help your end users heighten their awareness and improve on their knowledge of potential threats.
Send Us Your Feedback
Your valuable feedback enables us to continue improving and adding features that support the goal of making Office 365 more secure. We encourage you to begin a free Office 365 E5 trial today and begin further enhancing your security for Office 365 today.
With the kickoff of InfoSec Europe, we shared an update of our recent enhancements to Office 365 threat protection services. Today, we discuss the significant enrichment to the end user experience in Office 365. By empowering end users to make better decisions which help drive proactive protection, we offer an unique, powerful, and potentially best in class solution. The features we showcase today provide end users greater information, enabling better decision making and ultimately greater security.
Introducing Native Link Rendering
‘Native Link Rendering’ is now available for customers using Office Web Application (OWA). Soon the feature will also be available for the Outlook client. ‘Native Link Rendering’ exposes the native link for a user to view, though we still wrap the link in the back end for analysis. Importantly, no other advanced security solution can provide this powerful and crucial feature. Native Link Rendering has been a top request from customers because it supports end user education by providing visibility to the original view of an URL. Office 365 ATP’s Safe Links ‘time-of-click-protection’ protects users from clicking through to a malicious site. To do so, Safe Links wraps the link at the time of click, obfuscating the native URL which reduces users’ ability to learn what a potentially malicious URL may look like. Customers educating end users on indicators of a malicious link, require the display of native links since wrapped links prevent the ability to train users. ‘Native Link Rendering’ lets users see the original link. It is an unique and critical feature serving to empower our customer’s users to become more aware, sophisticated, and proactive at preventing themselves from being compromised by malicious links. Microsoft believes education and awareness is a foundational element for holistic security and Native Link Rendering serves to both educate and raise user awareness on cyberthreats.
Figure 1. Native Link Rendering Feature showing the original URL in the hover window
Enhanced Safe Links Warning Pages
The end user experience is further enhanced with new Safe Links warning pages. The new warning pages provide granular details on why a warning is generated. The pages range from notifying the user that a link is still being scanned, to a generic error warning.
Figure 2. Summary of New Safe Links Warning Pages
With this greater detail, users have better information on why a link was flagged, facilitating user understanding of when and why threats are blocked. Ultimately, a more informed user base can make better decisions and can better protect themselves from threats. We are excited to help your end users heighten their awareness and improve on their knowledge of potential threats.
Send Us Your Feedback
Your valuable feedback enables us to continue improving and adding features that support the goal of making Office 365 more secure. We encourage you to begin a free Office 365 E5 trial today and begin further enhancing your security for Office 365 today.
With the kickoff of InfoSec Europe, we shared an update of our recent enhancements to Office 365 threat protection services. Today, we discuss the significant enrichment to the end user experience in Office 365. By empowering end users to make better decisions which help drive proactive protection, we offer an unique, powerful, and potentially best in class solution. The features we showcase today provide end users greater information, enabling better decision making and ultimately greater security.
Introducing Native Link Rendering
‘Native Link Rendering’ is now available for customers using Office Web Application (OWA). Soon the feature will also be available for the Outlook client. ‘Native Link Rendering’ exposes the native link for a user to view, though we still wrap the link in the back end for analysis. Importantly, no other advanced security solution can provide this powerful and crucial feature. Native Link Rendering has been a top request from customers because it supports end user education by providing visibility to the original view of an URL. Office 365 ATP’s Safe Links ‘time-of-click-protection’ protects users from clicking through to a malicious site. To do so, Safe Links wraps the link at the time of click, obfuscating the native URL which reduces users’ ability to learn what a potentially malicious URL may look like. Customers educating end users on indicators of a malicious link, require the display of native links since wrapped links prevent the ability to train users. ‘Native Link Rendering’ lets users see the original link. It is an unique and critical feature serving to empower our customer’s users to become more aware, sophisticated, and proactive at preventing themselves from being compromised by malicious links. Microsoft believes education and awareness is a foundational element for holistic security and Native Link Rendering serves to both educate and raise user awareness on cyberthreats.
Figure 1. Native Link Rendering Feature showing the original URL in the hover window
Enhanced Safe Links Warning Pages
The end user experience is further enhanced with new Safe Links warning pages. The new warning pages provide granular details on why a warning is generated. The pages range from notifying the user that a link is still being scanned, to a generic error warning.
Figure 2. Summary of New Safe Links Warning Pages
With this greater detail, users have better information on why a link was flagged, facilitating user understanding of when and why threats are blocked. Ultimately, a more informed user base can make better decisions and can better protect themselves from threats. We are excited to help your end users heighten their awareness and improve on their knowledge of potential threats.
Send Us Your Feedback
Your valuable feedback enables us to continue improving and adding features that support the goal of making Office 365 more secure. We encourage you to begin a free Office 365 E5 trial today and begin further enhancing your security for Office 365 today.
![Admins- welcome to the Microsoft 365 admin center]()
We built Microsoft 365- a complete IT solution including Office 365, Windows 10, and Enterprise Mobility + Security- to enable organizations to create and work together securely. In that same spirit, our goal is to offer a unified toolset to manage and protect those organizations. In March, we announced the Microsoft 365 admin center as your central location for managing and monitoring applications, services, data, devices, and users across your Microsoft 365 deployment.
Today, we are expanding this integrated and intuitive admin experience to users of Office 365. Users of both Office 365 and Microsoft 365 will now have access to the new Microsoft 365 admin center. For Office 365 admins, this means a simpler experience that easily integrates with you other Microsoft services – all without giving up capabilities or control.
What to expect
If you’ve used the Office 365 admin center before, the experience will feel very similar. The navigation is the same, and you’ll have the same granularity of control over your environment. There will be no change to your Office 365 subscription or billing. As you add new apps and services like device management, those will light up in your left navigation pane. Most importantly, you’ll receive all the latest admin center updates and features as they become available.
New URL, same great experience
To access your new admin center experience, point your web browser to admin.microsoft.com. This is your new front door for managing and monitoring all your Office 365 and Microsoft 365 services. Your new admin center still includes links to all your specialty admin tools for services like OneDrive and SharePoint conveniently linked in the left navigation pane. If you’ve previously created bookmarks for the Office 365 admin center or any of the specialty admin centers, those will continue to work.
Over the next few weeks, we will be updating the admin center links across Office 365 to use the new admin.microsoft.com address.
More to come
In the coming months, we’ll continue to evolve the Microsoft 365 admin center to provide a consistent and intuitive experience across all your Microsoft 365 products. As more information becomes available, we’ll post it here on Microsoft Tech Communities. In the meantime, join the conversation on the Microsoft 365 Tech Communities forums and Twitter.
Investigative Tools to Empower Stronger Threat Protection
We launched Office 365 Threat Intelligence to help organization’s become more secure by enhancing admin capabilities which offer greater visibility, deeper insights, and powerful executable actions (check out the recent webinar overviewing the service). Today we’re excited to announce ‘Threat Trackers’ for Office 365 Threat Intelligence, enabling efficient monitoring and management of threat investigations to help admins quickly remediate and respond to threats. The feature can be found under ‘Threat Management’ in the Security and Compliance Center. Table 1 summarizes the four available ‘Threat tracker’ categories.
Table 1. The different tracker categories available in Office 365 Threat Intelligence Threat Trackers view
Threat Tracker Categories
Noteworthy campaigns are classified, as well known and important global threats. Office 365 Threat Intelligence pre-builds Noteworthy Campaign monitors, enabling admins to quickly review the impact of these threats, assessing both their volume and frequency. This automated monitoring allows admins speedy remediation from these threats. Noteworthy Campaign monitors update hourly, showing the latest impact of these threats to your organization. Click ‘Explore’ if you want to see the detailed events detected by the filter.
The Trending Campaigns view provides dynamic assessments of email threats impacting your organization’s Office 365 environment. This view shows tenant level malware trends, identifying malware families on the rise, flat, or declining, giving admins greater insight into which threats require further attention. New threats not seen recently in your organization will appear at the top of the page (sorted by trend). Trending Campaigns also offers a comparative view on how a threat impacts your organization versus others. If an organization’s targeting percentage is >10%, it indicates that it is being specifically targeted by the attack. Admins can further investigate targeted and trending attacks in Explorer, where actions such as deleting or moving the malware to junk can be taken. Targeted attacks are typically short-lived, so these types of attacks in the Trending Campaigns view may drop out of the view within a few days.
Figure 1. The Trending Campaigns view in Office 365 Threat Intelligence Threat trackers
While the campaign views enable tracking and quick assessment of threats, queries are powerful investigative views allowing deeper understanding of threats, aiding admins to make data driven security updates. Queries can be accessed from either campaign view by clicking on ‘Explorer’ which displays that tracked threat campaign. Saved Queries provides a view into all Explorer searches saved as queries. Admins can monitor malware and phish events with the scope (number of emails included in an incident) defined and saved from Explorer. Saved queries are useful for checking items frequently. To create more saved queries, go to the Explorer, add filters to view specific sets of events, then select ‘Save query’ (button at top of page).
Figure 2. Opened Explorer page on tracked threat campaign. The threat campaign can be saved as query from the Explorer
Tracked queries provide regular assessments of malware, phish, and other events with the scope defined from Threat Explorer. Tracked queries help monitor items frequently, providing reports, allowing quick and in-depth evaluation of threats or groups. A limited number of tracked queries are available for each organization. Admins can choose to convert saved queries and begin tracking them using the edit option for that query.
These ‘Threat Trackers’ enrich the admin experience, providing a powerful new tool for monitoring and managing, investigations, which ultimately enables quick response to threats. With this added feature, Office 365 Threat Intelligence provides admins to more efficiently and easily secure their organization.
Send Us Your Feedback
Let us know what you think of the new Threat trackers feature by beginning an Office 365 E5 trial today to experience the powerful capabilities of Office 365 Threat Intelligence. Your feedback enables us to make updates and enhancements to provide you with the best protection for Office 365. Please watch our recent webinar on Office 365 Threat Intelligence to learn further details on how the service can help your organization become more secure.
Investigative Tools to Empower Stronger Threat Protection
We launched Office 365 Threat Intelligence to help organization’s become more secure by enhancing admin capabilities which offer greater visibility, deeper insights, and powerful executable actions (check out the recent webinar overviewing the service). Today we’re excited to announce ‘Threat Trackers’ for Office 365 Threat Intelligence, enabling efficient monitoring and management of threat investigations to help admins quickly remediate and respond to threats. The feature can be found under ‘Threat Management’ in the Security and Compliance Center. Table 1 summarizes the four available ‘Threat tracker’ categories.
Table 1. The different tracker categories available in Office 365 Threat Intelligence Threat Trackers view
Threat Tracker Categories
Noteworthy campaigns are classified, as well known and important global threats. Office 365 Threat Intelligence pre-builds Noteworthy Campaign monitors, enabling admins to quickly review the impact of these threats, assessing both their volume and frequency. This automated monitoring allows admins speedy remediation from these threats. Noteworthy Campaign monitors update hourly, showing the latest impact of these threats to your organization. Click ‘Explore’ if you want to see the detailed events detected by the filter.
The Trending Campaigns view provides dynamic assessments of email threats impacting your organization’s Office 365 environment. This view shows tenant level malware trends, identifying malware families on the rise, flat, or declining, giving admins greater insight into which threats require further attention. New threats not seen recently in your organization will appear at the top of the page (sorted by trend). Trending Campaigns also offers a comparative view on how a threat impacts your organization versus others. If an organization’s targeting percentage is >10%, it indicates that it is being specifically targeted by the attack. Admins can further investigate targeted and trending attacks in Explorer, where actions such as deleting or moving the malware to junk can be taken. Targeted attacks are typically short-lived, so these types of attacks in the Trending Campaigns view may drop out of the view within a few days.
Figure 1. The Trending Campaigns view in Office 365 Threat Intelligence Threat trackers
While the campaign views enable tracking and quick assessment of threats, queries are powerful investigative views allowing deeper understanding of threats, aiding admins to make data driven security updates. Queries can be accessed from either campaign view by clicking on ‘Explorer’ which displays that tracked threat campaign. Saved Queries provides a view into all Explorer searches saved as queries. Admins can monitor malware and phish events with the scope (number of emails included in an incident) defined and saved from Explorer. Saved queries are useful for checking items frequently. To create more saved queries, go to the Explorer, add filters to view specific sets of events, then select ‘Save query’ (button at top of page).
Figure 2. Opened Explorer page on tracked threat campaign. The threat campaign can be saved as query from the Explorer
Tracked queries provide regular assessments of malware, phish, and other events with the scope defined from Threat Explorer. Tracked queries help monitor items frequently, providing reports, allowing quick and in-depth evaluation of threats or groups. A limited number of tracked queries are available for each organization. Admins can choose to convert saved queries and begin tracking them using the edit option for that query.
These ‘Threat Trackers’ enrich the admin experience, providing a powerful new tool for monitoring and managing, investigations, which ultimately enables quick response to threats. With this added feature, Office 365 Threat Intelligence provides admins to more efficiently and easily secure their organization.
Send Us Your Feedback
Let us know what you think of the new Threat trackers feature by beginning an Office 365 E5 trial today to experience the powerful capabilities of Office 365 Threat Intelligence. Your feedback enables us to make updates and enhancements to provide you with the best protection for Office 365. Please watch our recent webinar on Office 365 Threat Intelligence to learn further details on how the service can help your organization become more secure.
Investigative Tools to Empower Stronger Threat Protection
We launched Office 365 Threat Intelligence to help organization’s become more secure by enhancing admin capabilities which offer greater visibility, deeper insights, and powerful executable actions (check out the recent webinar overviewing the service). Today we’re excited to announce ‘Threat Trackers’ for Office 365 Threat Intelligence, enabling efficient monitoring and management of threat investigations to help admins quickly remediate and respond to threats. The feature can be found under ‘Threat Management’ in the Security and Compliance Center. Table 1 summarizes the four available ‘Threat tracker’ categories.
Table 1. The different tracker categories available in Office 365 Threat Intelligence Threat Trackers view
Threat Tracker Categories
Noteworthy campaigns are classified, as well known and important global threats. Office 365 Threat Intelligence pre-builds Noteworthy Campaign monitors, enabling admins to quickly review the impact of these threats, assessing both their volume and frequency. This automated monitoring allows admins speedy remediation from these threats. Noteworthy Campaign monitors update hourly, showing the latest impact of these threats to your organization. Click ‘Explore’ if you want to see the detailed events detected by the filter.
The Trending Campaigns view provides dynamic assessments of email threats impacting your organization’s Office 365 environment. This view shows tenant level malware trends, identifying malware families on the rise, flat, or declining, giving admins greater insight into which threats require further attention. New threats not seen recently in your organization will appear at the top of the page (sorted by trend). Trending Campaigns also offers a comparative view on how a threat impacts your organization versus others. If an organization’s targeting percentage is >10%, it indicates that it is being specifically targeted by the attack. Admins can further investigate targeted and trending attacks in Explorer, where actions such as deleting or moving the malware to junk can be taken. Targeted attacks are typically short-lived, so these types of attacks in the Trending Campaigns view may drop out of the view within a few days.
Figure 1. The Trending Campaigns view in Office 365 Threat Intelligence Threat trackers
While the campaign views enable tracking and quick assessment of threats, queries are powerful investigative views allowing deeper understanding of threats, aiding admins to make data driven security updates. Queries can be accessed from either campaign view by clicking on ‘Explorer’ which displays that tracked threat campaign. Saved Queries provides a view into all Explorer searches saved as queries. Admins can monitor malware and phish events with the scope (number of emails included in an incident) defined and saved from Explorer. Saved queries are useful for checking items frequently. To create more saved queries, go to the Explorer, add filters to view specific sets of events, then select ‘Save query’ (button at top of page).
Figure 2. Opened Explorer page on tracked threat campaign. The threat campaign can be saved as query from the Explorer
Tracked queries provide regular assessments of malware, phish, and other events with the scope defined from Threat Explorer. Tracked queries help monitor items frequently, providing reports, allowing quick and in-depth evaluation of threats or groups. A limited number of tracked queries are available for each organization. Admins can choose to convert saved queries and begin tracking them using the edit option for that query.
These ‘Threat Trackers’ enrich the admin experience, providing a powerful new tool for monitoring and managing, investigations, which ultimately enables quick response to threats. With this added feature, Office 365 Threat Intelligence provides admins to more efficiently and easily secure their organization.
Send Us Your Feedback
Let us know what you think of the new Threat trackers feature by beginning an Office 365 E5 trial today to experience the powerful capabilities of Office 365 Threat Intelligence. Your feedback enables us to make updates and enhancements to provide you with the best protection for Office 365. Please watch our recent webinar on Office 365 Threat Intelligence to learn further details on how the service can help your organization become more secure.
