Microsoft Defender For Office 365 - Quick Reference Guide

This document provides an overview of the transition from Mimecast to Microsoft Defender for Office 365 for managing spam and malware email protection, detailing the new features and functionalities.

• Transition Overview: The document outlines the shift from Mimecast to Microsoft Defender for Office 365, emphasizing the new spam notification system and quarantine management features. Users will now see different spam notifications and can review quarantined messages easily. 
• Handling Blocked Emails: It discusses the challenges of spam protection, acknowledging that some legitimate emails may be blocked. Users can check for blocked emails via a specific link if they haven't received notifications. 
• Safe Senders and Quarantine Management: Instructions are provided on how to add safe senders and manage quarantined emails, including retention policies and how to delete emails from the quarantine list manually.

This is what you see now:
*Old Mimecast Spam, notifications*:
This is what you will see moving forward when the change is made:
*New Microsoft Defender Spam Notifications*:
If you want to preview the message or see a list of all your quarantined messages, then click on “Review Message” button, or go to link to your “Quarantine Page” and click preview.


From the original messages you can also choose to release the messages or block the sender from sending further messages if you wish.

Concerned You Have Blocked E-mail From A Genuine Source?
The "art" of Spam protection is hard and finding the right balance between security and not impacting business is an ongoing battle, with malicious actors constantly finding new ways to abuse e-mail.

With this said, it is inevitable that a few items will continue to be blocked that perhaps should not be, or that you do not consider spam where others do.

If you have concerns that an e-mail has been blocked, and you have not received a notification, then you can check by going to: https://security.microsoft.com/quarantine, to check & get some reassurance.

Adding Safe Senders

You can add senders or sender’s domains to your own Safe Senders List, there are two ways to do this:

Initially in the quarantine portal, select the mail, click on “more” and then “allow sender”: 

*Note: if the sender is already in your safe senders list, the option will not appear, also, you can only select one e-mail at a time to allow a sender, same with blocking a sender aswell*

Once the e-mail has been released you can achieve the same in Outlook by using the Junk menu option:

*Note: The “Junk Menu” option can appear in slightly different locations on a user’s outlook view depending on a few variables, they option is in outlook though*

You can view your safe senders list using the link below:
https://outlook.office365.com/mail/options/mail/junkEmail
 Or through Outlook Settings -> Junk Email

Quarantine List (Portal)
When you have dealt with an e-mail within the quarantine portal (either blocked, allowed the sender or released) the e-mail will remain visible to you in the quarantine list for 30 days for retention purposes, before it is deleted from the list.

If you do not want to see the e-mail once dealt with, you can delete it manually yourself after dealing with it, to remove it from your quarantine list prior to the 30-day auto deletion. 

Old Quarantined E-mails

Note: Any old, quarantined e-mails that you may not have released prior to the change, can still be accessed and released by yourself using the same method you do today via Mimecast, but all new mail after the change will be filtered through Microsoft Defender, therefore the above new way applies.