Microsoft is adding new security features to Office 365

guest · Jun 24, 2020

Safe Documents Feature in Microsoft 365 Apps Now Generally Available
June 23, 2020
https://www.securityweek.com/safe-documents-feature-microsoft-365-apps-now-generally-available

Initially introduced in November, Safe Documents brings Office ATP capabilities to the desktop and provides users with increased protection compared to Protected View, which was first announced in Office 2010.

With Safe Documents now generally available for Microsoft 365 E5 and Microsoft 365 E5 Security licenses for Commercial and Education customers on Windows clients, untrusted files are verified to ensure that no harm would come to a user’s machine when exiting Protected View.
Users often exit the protection sandbox that Protected View delivers without considering whether the document originating from outside the organization is safe or not, thus exposing enterprises to potential attacks.
Click to expand...

Safe Documents, which takes advantage of Microsoft Intelligent Security Graph, automatically verifies the document to determine if it poses a security risk before allowing the user to leave Protected View (the document is uploaded and scanned by Microsoft Defender Advanced Threat Protection).

During the scan, users are not allowed to exit the Protected View container, although they can access and read the document. Editing is not available either.
Click to expand...

Microsoft: Safe Documents is Generally Available

Building on secure productivity, today we announce the general availability of Safe Documents*, a new Microsoft 365 Apps feature that keeps enterprise users safe by verifying untrusted files on their behalf.
Click to expand...

guest · Jul 20, 2020

Office 365 adds new security configuration analysis feature
July 20, 2020
https://www.bleepingcomputer.com/ne...-new-security-configuration-analysis-feature/

Microsoft is working on a new Office 365 Advanced Threat Protection (ATP) feature which will make it easy to determine your security policies settings' effectiveness when compared to recommended settings.

The new feature, named Configuration Analyzer, "will be a place for you to compare your policies settings against the Recommended settings for EOP and Office 365 ATP security," according to Microsoft.

"Config Analyzer will measure your current policy settings against either the Standard or the Strict recommendations."
Rolling out next month
Office 365 security administrators will also be able to use the new tool to access a setting changes history area that will make it easy to evaluate how policy changes affected their environment.
The two security levels are designed to provide different anti-spam, anti-malware, and anti-phishing configurations for blocking malicious emails from reaching the users' mailboxes, depending on each customer's needs and environment.
Click to expand...

Part of a broad effort to secure Office 365
Redmond is now rolling out a new Office 365 ATP mail latency summary report to provide users with more info on the route incoming emails take while going through the filtering stack before reaching their inboxes, as well as on the effectiveness of any configuration changes they made to their security configurations.
Click to expand...

guest · Jul 28, 2020

Office 365 adds new features to help identify malicious spam
July 27, 2020
https://www.bleepingcomputer.com/ne...new-features-to-help-identify-malicious-spam/

Microsoft is planning to provide more info on spam emails detected as malicious by the Office 365 Advanced Threat Protection (ATP) filtering stack and allow organizations to export their list of the top targeted users by phishing attacks.

Additional improvements to the Office 365 ATP Threat Explorer will make it easier for customers to gain access to extra details on post-delivery actions following Manual Remediation or Exchange Online zero-hour auto-purge (ZAP).
Rolling out in Q3 2020
Microsoft mentions the "addition of spam verdict within Threat Explorer, so that going forward you will be able to identify if a particular email was Malware, Phish or Spam," and the introduction of "Threat Type Filter for All Email View, so that you can directly go to All-Email view and filter out the malicious emails."
Click to expand...

Last, but not least, in a separate Microsoft 365 roadmap entry, Redmond also says that Office 365 ATP will make it possible to "export the list of Top Targeted Users across each view for offline analysis."
Microsoft wants to roll out these Office 365 enhancements during Q3 2020 and to make them generally available for all customers with an Advanced Threat Protection plan in standard multi-tenant Office 365 environments.
Click to expand...

guest · Aug 10, 2020

Office 365 will let you manage phishing simulation emails
August 10, 2020
https://www.bleepingcomputer.com/ne...ll-let-you-manage-phishing-simulation-emails/

Microsoft is adding support for allowing emails containing malicious URLs or attachments to reach the mailboxes of end-users to make it easier to run phishing training sessions or simulations.

This will be done via a self-remediation portal by enabling Office 365 security administrators to choose items that could contain threats and to allow them to reach the recipients' inboxes after passing through all layers of the Office 365 Exchange Online Protection (EOP) filtering stack.
Dedicated Allow/Block list portal

"We understand that from time to time, customers may want to ensure delivery of certain messages containing malicious content for specific reasons, such as phishing simulations and training," the company explains on the feature's roadmap page.
To help customers get around having their phishing simulation emails getting blocked, Microsoft's new portal gives admins the possibility to explicitly allow or block certain attachments and URLs in their Office 365 tenants through the new Tenant Allow/Block list portal.
Click to expand...

Microsoft wants to roll out the Tenant Allow/Block list portal during Q3 2020 and to make it generally available to all customers with an Advanced Threat Protection plan in all Office 365 environments.
Click to expand...

guest · Aug 24, 2020

Office 365 now opens attachments in a sandbox to prevent infections
August 24, 2020
https://www.bleepingcomputer.com/ne...tachments-in-a-sandbox-to-prevent-infections/

Microsoft today announced the launch of Application Guard for Office in public preview to protect enterprise users from threats using malicious attachments as an attack vector.

Application Guard for Office (also known as Microsoft Defender Application Guard for Office) is designed to help prevent block files downloaded from untrusted sources from gaining access trusted resources by opening them within an isolated sandbox.
This sandbox will automatically block maliciously crafted files from exploiting vulnerabilities, downloading other malicious tools, or manifesting any malicious behavior from impacting the users' device and data.

Application Guard for Office was initially launched in limited preview last year, in November 2019.
Click to expand...

Off by default in supported environments
Malicious Office documents are among the most common vectors exploited by threat actors to deploy malware such as ransomware, RATs, data-stealing trojans, and malware downloaders.

"To help protect your users, Office opens files from potentially unsafe locations in Application Guard, a secure container that is isolated from the device through hardware-based virtualization," Microsoft Sr. Office Deployment Engineer Eric Wayne said.
Application Guard for Office is integrated with the Microsoft Defender Advanced Threat Protection enterprise endpoint security platform, providing malicious activity monitoring and alerting within the isolated environment.
Click to expand...

Rasheed187 · Aug 29, 2020

mood said: ↑

Office 365 now opens attachments in a sandbox to prevent infections
August 24, 2020
https://www.bleepingcomputer.com/ne...tachments-in-a-sandbox-to-prevent-infections/
Click to expand...

LOL, Sandboxie has been doing this since 2004. M$ is a bit late to the game, but what else is new.

guest · Sep 11, 2020

Office 365 will let users view their quarantined phishing messages
September 11, 2020
https://www.bleepingcomputer.com/ne...ers-view-their-quarantined-phishing-messages/

Microsoft is planning to allow Office 365 users to view and request the release of phishing messages automatically quarantined by the Exchange Online Protection (EOP) filtering stack.

This new capability is designed to make it possible for end-users to reclaim e-mails that have been accidentally marked as phishing or spam messages by Office 365 EOP.
EOP is a cloud-based filtering service designed to scan for and quarantine spam and emails with malicious attachments from ending up in users' Exchange Online inboxes.
Office 365 phishing email triage for end-users

"We understand that managing false positives is important to ensuring email is delivered appropriately, and in the past, end-users weren't granted access to the quarantine to view messages," Microsoft explains on the new feature's roadmap entry.
The company will introduce this new option to provide users with read-only access to view and triage quarantined messages, as well as to "request that an admin release messages to the inbox."
Click to expand...

Microsoft plans to roll out the new Office 365 ATP Request Release workflow this month and to make it generally available to all customers with an Advanced Threat Protection plan in all Office 365 environments.
Click to expand...

guest · Sep 15, 2020

mood said: ↑

Office 365 now opens attachments in a sandbox to prevent infections August 24, 2020
Click to expand...

Microsoft Defender Application Guard for Office explained
September 15, 2020
https://www.ghacks.net/2020/09/15/microsoft-defender-application-guard-for-office-explained/

Microsoft Defender Application Guard for Office is a new security feature designed to load untrusted Office documents, e.g. an Excel spreadsheet downloaded from the Internet, in an isolated environment to keep the underlying system and its data protected against potential attacks.

The security feature is based on Microsoft Defender Application Guard, which is designed to load untrusted sites in an isolated container using automated and standalone modes. Automated mode, called Enterprise Management Mode, has an admin define trusted sites through GPO or other management interfaces. These sites are loaded normally on the system while all other sites are considered untrusted and therefore launched in the virtual environment.
Click to expand...

Microsoft Defender Application Guard for Office attempts to address threats that exploit weaknesses in Microsoft Office that related to the supported documents or its features. The core idea is to launch untrusted files in a safe environment to avoid interactions with the host system, its data, and the network.
Office users can still view, edit, print, and save documents in the Office application.
Click to expand...

guest · Oct 7, 2020

Microsoft adds consent phishing protection to Office 365
October 7, 2020
https://www.bleepingcomputer.com/ne...ds-consent-phishing-protection-to-office-365/

Microsoft announced that consent phishing protections including OAuth app publisher verification and app consent policies are now generally available in Office 365.

These protections are designed to defend Office 365 users from an application-based phishing attack variant known as consent phishing.
In this type of phishing attack, targets are tricked into providing access to their Office 365 accounts by granting permissions to malicious Office 365 OAuth apps (web apps attackers register with an OAuth 2.0 provider).
Click to expand...

Easier to block apps coming from unverified sources
Publisher verification enables developers to "add a verified identity to their app registrations and demonstrate to customers that the app comes from an authentic source."

All Office 365 users will be protected from app-based attacks now that publisher verification is generally available as they "will no longer be able to consent to new multi-tenant apps registered after November 8th, 2020 coming from unverified publishers."
Click to expand...

guest · Oct 16, 2020

Office 365 adds protection against downgrade and MITM attacks
October 16, 2020
https://www.bleepingcomputer.com/ne...rotection-against-downgrade-and-mitm-attacks/

Microsoft is working on adding SMTP MTA Strict Transport Security (MTA-STS) support to Exchange Online to ensure Office 365 customers' email communication security and integrity.

Once MTA-STS is available in Office 365 Exchange Online, emails sent by users via Exchange Online will only one delivered using connections with both authentication and encryption, protecting against both email interception and attacks.
Protection against MITM and downgrade attacks
MTA-STS strengthens Exchange Online email security and solves multiple SMTP security problems including the lack of support for secure protocols, expired TLS certificates, and certs not issued by trusted third parties or matching server domain names.

"[D]owngrade attacks are possible where the STARTTLS response can be deleted, thus rendering the message in clear text," Microsoft says. "Man-in-the-middle (MITM) attacks are also possible, whereby the message can be rerouted to an attacker’s server."
Click to expand...

DNSSEC and DANE for SMTP also coming
Microsoft is also working on including support for the DNSSEC (Domain Name System Security Extensions) and DANE for SMTP (DNS-based Authentication of Named Entities) to Office 365 Exchange Online.

Support for the two SMTP standards will be added to both inbound and outbound mail, "specific to SMTP traffic between SMTP gateways" according to the Microsoft 365 roadmap [1, 2] and this blog post.
Click to expand...

guest · Oct 23, 2020

Microsoft adds protection for critical accounts in Office 365
October 23, 2020
https://www.bleepingcomputer.com/ne...otection-for-critical-accounts-in-office-365/

Microsoft is working on improving Microsoft Defender for Office 365 with priority protection features for accounts of high-profile employees like executive-level managers that threat actors target most often.

The feature is currently in public preview and Microsoft plans to make it generally available to all customers with Microsoft Defender Advanced Threat Protection in November 2020.
Easier to focus protection efforts on the C-suite
"Over the past few years, attackers have increasingly moved from targeting infrastructure or devices to targeting users," Microsoft says in a roadmap entry detailing the new feature.

"As a result, organizations need protection for all users, but even more protection for their most visible and targeted employees."
Click to expand...

guest · Nov 19, 2020

mood said: ↑

Microsoft adds protection for critical accounts in Office 365 October 23, 2020
Click to expand...

Microsoft rolls out protection for critical accounts in Office 365
November 19, 2020
https://www.bleepingcomputer.com/ne...otection-for-critical-accounts-in-office-365/

Microsoft has launched Office 365 priority protection for accounts of high-profile employees such as executive-level managers who are most often targeted by threat actors.

The new feature was added to Microsoft Defender for Office 365 (previously known as Office 365 ATP) which provides enterprise accounts with email threat protection from advanced threats including business email compromise and credential phishing, as well as automated remediation of detected attacks.
Enterprise security teams can also identify attacks targeting critical Office 365 accounts easier and quickly switch their efforts to campaign investigations involving C-suite users.

"These Priority account tags and filters will surface throughout the product, including in alerts, Threat Explorer, Campaign Views, and reports," Microsoft previously said last month, when the feature was still in development.
Click to expand...

Priority account protection can be configured by going into the Security & Compliance Center as Microsoft 365 marketing manager Scott Schnoll explained.
Customers are required to have Defender for Office 365 Plan 2 subscriptions to get access to this new feature, including those with Office 365 E5, Microsoft 365 E5, or Microsoft 365 E5 Security.
Click to expand...

JRViejo · Jan 28, 2021

Application Guard for Office, a defensive technology that quarantines untrusted Office documents, had been available in public preview for five months.
Click to expand...

Microsoft releases Application Guard for Office to M365 customers by Gregg Keizer.

Floyd 57 · Jan 28, 2021

JRViejo said: ↑

Microsoft releases Application Guard for Office to M365 customers by Gregg Keizer.
Click to expand...

Idk if u guys know, but my grandma uses office as part of her job (invoices, documents, charts sheets etc.), recently she switched to office.com online, and she says there is no loss of functionality compared office 2019 that she used. So u might wanna try that if u dont wanna pay for expensive suites, not to mention malware and hassle free cuz u can edit online any time

BoerenkoolMetWorst · Jan 28, 2021

Application Guard for Office now generally available
https://techcommunity.microsoft.com...r-office-now-generally-available/ba-p/2007539

JRViejo · Feb 25, 2021

The move is more evidence, as if it's needed, that Microsoft remains eager to push, pull, and prod commercial customers into service-like subscriptions.
Click to expand...

Microsoft to cut perpetual Office support by 50%, raise price by 10% by Gregg Keizer.

guest · Aug 25, 2021

Microsoft will add secure preview for Office 365 quarantined emails
August 25, 2021
https://www.bleepingcomputer.com/ne...re-preview-for-office-365-quarantined-emails/

Microsoft is updating Defender for Office 365 to protect customers from embedded email threats while previewing quarantined emails.

Microsoft Defender for Office 365 (previously Office 365 Advanced Threat Protection) provides Office 365 enterprise email accounts with protection from multiple threats, including business email compromise and credential phishing, as well as automated attack remediation.
The soon-to-be-released update is designed to limit users' exposure to unwanted or malicious content by adding additional security controls to block embedded threats.

"We're changing the way users preview quarantined messages to provide additional security against embedded threats," Microsoft explains on the Microsoft 365 roadmap.
Click to expand...

Besides secured preview of quarantined emails, Microsoft Defender for Office 365 will also roll out other key quarantine management features that will make it easier for security operations (SecOps) teams and end-users to triage emails:

Quarantine folder policy and user release request workflow

Customer organization branding

Streamlined email submission from the quarantine portal

Robust release of bulk quarantined emails

Quarantine support for shared mailboxes

Click to expand...

JRViejo · Oct 5, 2021

Microsoft is cutting off some versions of Outlook from Microsoft 365 and Office 365 next month. And it plans more security moves a year from now that could affect how email is handled. Time to plan ahead.
Click to expand...

How to make sense of Microsoft’s upcoming mail security changes by Susan Bradley

guest · Oct 8, 2021

Microsoft is disabling Excel 4.0 macros by default to protect users
October 7, 2021
https://www.bleepingcomputer.com/ne...-excel-40-macros-by-default-to-protect-users/

Microsoft will soon begin disabling Excel 4.0 XLM macros by default in Microsoft 365 tenants to protect customers from malicious documents.

Excel 4.0 macros, or XLM macros, were first added to Excel in 1992 and allowed users to enter various commands into cells that are then executed to perform a task.
Click to expand...

While VBA macros were introduced in Excel 5.0, threat actors continue to XLM macros twenty years later in malicious documents that download malware or perform other unwanted behavior.
Malicious campaigns utilizing Excel 4.0 XLM macros include ones for malware, such as TrickBot, Qbot, Dridex, Zloader, and many more.
Microsoft to disable Excel 4.0 macros in all tenants
Instead of waiting for organizations to disable XLM macros on their own, Microsoft announced yesterday that they would be disabling Excel 4.0 macros by default starting in October in preview builds and then moving onto the current channel in November.

"We are introducing a change to the Excel Trust Center Macro settings to provide a more secure experience for users by default. This new default behavior will disable Excel 4.0 macros," explained an advisory in the Microsoft 365 message center.
Click to expand...

When the change rolls out, the Enable XLM macros when VBA macros are enabled setting will be unchecked by default, which disables XLM macros.
Click to expand...

guest · Oct 20, 2021

Microsoft 365 will get enhanced insider risk management tools
October 20, 2021
https://www.bleepingcomputer.com/ne...l-get-enhanced-insider-risk-management-tools/

Microsoft is updating Microsoft 365 to allow admins to better manage insider security threats in their environments with improvements to risky activity detection and visibility.

Insider Risk Management enables Microsoft 365 cloud services platform customers to detect, investigate, and remediate insider security threats within their organizations across Office, Windows, Azure, and third-party apps like HR systems.
It connects signals, including file activity and abnormal user behavior, to detect concealed patterns and risks that other, more traditional methods could miss.
Click to expand...

As the company revealed on the Microsoft 365 roadmap, the compliance center will get policy customization enhancements that allow fine-tuning policies to trigger on specific exfiltration events, in preview starting with November 2021.
In February 2022, Microsoft 365 users will also get better visibility of risky activity in their tenants via browsers and associated insider risk policy templates.

Last but not least, the company will start previewing new machine learning (ML) powered detections in April 2022 to help security operations (SecOps) teams spot hidden insider risks easier and faster.
Click to expand...

guest · Oct 24, 2021

Microsoft 365 will get support for custom ARC configurations
October 24, 2021
https://www.bleepingcomputer.com/ne...ll-get-support-for-custom-arc-configurations/

Microsoft is working on adding custom Authenticated Received Chain (ARC) configuration support to Microsoft Defender for Office 365.

ARC is an authentication mechanism that provides an authenticated "chain of custody" for messages that allows all intermediaries handling an email between the originating server to the recipient mailbox to see what other entities handled it previously.
Click to expand...

Enabling ARC for Office 365 hosted mailboxes prevents email authentication results from failing due to modifications made during the routing by intermediaries such as forwarding rules or mailing lists, before reaching a recipient's inbox. Thus, email authentication assessment results are preserved at each step during the delivery process across intermediaries.

"Email senders use authentication mechanisms like SPF, DKIM, DMARC to authenticate emails, but some legitimate intermediate services may potentially make changes to the email, which might cause the email to fail authentication at subsequent hop," Microsoft explains on the Microsoft 365 roadmap.
Microsoft estimates that this new feature will be generally available worldwide on web platforms next year, starting in March 2022.
Click to expand...

guest · Nov 20, 2021

Microsoft: Office 365 will boost default protection for all users
November 20, 2021
https://www.bleepingcomputer.com/ne...-will-boost-default-protection-for-all-users/

Microsoft is rolling out Built-In Protection to Defender for Office 365, a new feature that would automatically enable recommended settings and policies to make sure all new and existing users get at least a basic level of protection.

Microsoft Defender for Office 365 (previously known as Office 365 Advanced Threat Protection or Office 365 ATP) provides Office 365 enterprise email accounts with automated attack remediation and defends them from various threats, including business email compromise and credential phishing.

"Some security controls are inadvertently overlooked, and as a result some or all users are left with incomplete protection," said Defender for Office 365 Senior Program Manager Sundeep Saini.
"We are introducing Built-In Protection for Microsoft Defender for Office 365 to automatically elevate all users within your organization to the base level of security protection," the company explains on the Microsoft 365 roadmap.
Click to expand...

Once enabled, it will protect all existing and new end users across tenants from phishing emails with malicious attachments and links using Safe Attachments and Safe Links without requiring any actions from admins.

The rollout for this new default security preset is starting this month and will continue to standard multi-tenants worldwide through the end of the year, reaching general availability in December.
Click to expand...

guest · Jan 31, 2023

Microsoft Just Rolled Out Its Most Secure Microsoft 365 Version Yet
By Shaun - January 28, 2023

Microsoft recently announced that Microsoft Office 365 is ready for the cloud. They have created a secure environment with the Government's secure cloud. Microsoft claims that the new release comes with a secure variant of Outlook and email exchange, along with the standard office suite. It offers a different compliance and security level that is perfect for government use.
Click to expand...

The new 365 environment helps secure data, and Microsoft has confirmed that it uses on-prem servers to store most of the government data. This means the work can now move to the cloud using their SaaS (software as a service).
Government Productivity Tools
To give everyone a gist, the Department of Defense runs a Defense Information Systems Agency (DISA). They’ve designed a data handling protocol that protects cloud data in the government’s hands up to the highest level. Microsoft 365 offers a set of productivity tools and offers an IL6 (Impact Level 6) environment.

These tools help create an environment for classified information. Microsoft is confident that the new capabilities of 365 help tighten security. It also hopes to increase data visibility for the top-secret regions of the Azure government.
Click to expand...

Source: https://www.techradar.com/news/microsoft-just-rolled-out-its-most-secure-microsoft-365-version-yet
Click to expand...

Log in or Sign up

Microsoft is adding new security features to Office 365

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

JRViejo Super Moderator

Floyd 57 Registered Member

BoerenkoolMetWorst Registered Member

JRViejo Super Moderator

guest Guest

JRViejo Super Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Microsoft is adding new security features to Office 365

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

JRViejo Super Moderator

Floyd 57 Registered Member

BoerenkoolMetWorst Registered Member

JRViejo Super Moderator

guest Guest

JRViejo Super Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches