Skip to content

Commit 184bff3

Browse files
chrisdachrisda
committed
New MDO Teams articles
1 parent b0ff4ee commit 184bff3

File tree

3 files changed

+227
-0
lines changed

3 files changed

+227
-0
lines changed

‎defender-office-365/TOC.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,9 @@
101101
items:
102102
- name: Defender for Office 365 SecOps guide
103103
href: mdo-sec-ops-guide.md
104+
- name: Quickly configure Microsoft Teams protection
105+
href: mdo-support-teams-quick-configure.md
106+
104107
- name: Migrate
105108
items:
106109
- name: Migrate to Defender for Office 365
@@ -116,6 +119,8 @@
116119
items:
117120
- name: Defender for Office 365 SecOps Guide
118121
href: mdo-sec-ops-guide.md
122+
- name: SecOps guide for Teams protection in Defender for Office 365
123+
href: mdo-support-teams-sec-ops-guide.md
119124
- name: Threat classification
120125
href: mdo-threat-classification.md
121126
- name: Security recommendations for priority accounts
@@ -363,6 +368,8 @@
363368
href: office-365-ti.md
364369
- name: Defender for Office 365 SecOps Guide
365370
href: mdo-sec-ops-guide.md
371+
- name: SecOps guide for Teams protection in Defender for Office 365
372+
href: mdo-support-teams-sec-ops-guide.md
366373
- name: Analyze and classify
367374
items:
368375
- name: Campaign Views

‎defender-office-365/mdo-support-teams-quick-configure.md‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
---
2+
title: Quickly configure Microsoft Teams protection in Microsoft Defender for Office 365 Plan 2
3+
f1.keywords:
4+
- NOCSH
5+
ms.author: chrisda
6+
author: chrisda
7+
manager: deniseb
8+
audience: Admin
9+
ms.topic: overview
10+
ms.localizationpriority: medium
11+
search.appverid:
12+
- MET150
13+
- MOE150
14+
ms.collection:
15+
- m365-security
16+
- tier1
17+
description: Admins who aren't using Microsoft Defender for Office 365 can learn how to quickly set up protection in Microsoft Teams.
18+
ms.service: defender-office-365
19+
ms.date: 04/15/2025
20+
appliesto:
21+
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 2</a>
22+
---
23+
24+
## Quickly configure Microsoft Teams protection in Microsoft Defender for Office 365 Plan 2
25+
26+
Even if you aren't using Microsoft Defender for Office 365 Plan 2 for email protection, you can still use it for Microsoft Teams protection.
27+
28+
This article contains the quick steps to turn on and configure Defender for Office 365 protection for Microsoft Teams.
29+
30+
## What do you need to know before you begin?
31+
32+
- You open the Microsoft Defender portal at <https://security.microsoft.com>.
33+
34+
- You need to be assigned permissions before you can do the procedures in this article. You have the following options:
35+
- [Microsoft Defender XDR Unified role based access control (RBAC)](/defender-xdr/manage-rbac) (If **Email & collaboration** \> **Defender for Office 365** permissions is :::image type="icon" source="media/scc-toggle-on.png" border="false"::: **Active**. Affects the Defender portal only, not PowerShell): **Authorization and settings/Security settings/Core Security settings (manage)**.
36+
- [Email & collaboration permissions in the Microsoft Defender portal](mdo-portal-permissions.md) and [Exchange Online permissions](/exchange/permissions-exo/permissions-exo):
37+
- Membership in the **Organization Management** or **Security Administrator** role groups in Email & collaboration permissions <u>and</u> membership in the **Organization Management** role group in Exchange Online permissions.
38+
- [Microsoft Entra permissions](/entra/identity/role-based-access-control/manage-roles-portal): Membership in the **Global Administrator**<sup>\*</sup> or **Security Administrator** roles gives users the required permissions _and_ permissions for other features in Microsoft 365.
39+
40+
> [!IMPORTANT]
41+
> <sup>\*</sup> Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
42+
43+
- Allow up to 30 minutes for a new or updated policy to be applied.
44+
45+
- For more information about licensing requirements, see [Licensing terms](/office365/servicedescriptions/office-365-advanced-threat-protection-service-description#licensing-terms).
46+
47+
- Teams integration deployment is part of the overall deployment process of Defender for Office 365. For more information, see [Pilot and deploy Defender for Office 365](/defender-xdr/pilot-deploy-defender-office-365?toc=%2Fdefender-office-365%2FTOC.json&bc=%2Fdefender-office-365%2Fbreadcrumb%2Ftoc.json).
48+
49+
## Step 1: Verify Safe Attachments integration for Microsoft Teams
50+
51+
For complete instructions, see [Turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](safe-attachments-for-spo-odfb-teams-configure.md).
52+
53+
1. In the Microsoft Defender portal, go to the **Safe Attachments** page at <https://security.microsoft.com/safeattachmentv2>.
54+
2. On the **Safe Attachments** page, select :::image type="icon" source="media/m365-cc-sc-gear-icon.png" border="false"::: **Global settings**.
55+
3. In the **Global settings** flyout that opens, go to the **Protect files in SharePoint, OneDrive, and Microsoft Teams** section to verify **Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams** is :::image type="icon" source="media/scc-toggle-on.png" border="false"::: **On**.
56+
57+
If the value is :::image type="icon" source="media/scc-toggle-off.png" border="false"::: **Off**, move the toggle to :::image type="icon" source="media/scc-toggle-on.png" border="false"::: **On**, and then select **Save**.
58+
59+
> [!TIP]
60+
>
61+
> - You can't restrict Safe Attachments for SharePoint, OneDrive, and Microsoft Teams to Microsoft Teams only.
62+
> - You can't scope Safe Attachments for SharePoint, OneDrive, and Microsoft Teams to specific users. It's on or off for everyone.
63+
64+
## Step 2: Verify Safe Links integration for Microsoft Teams
65+
66+
For complete instructions, see [Use the Microsoft Defender portal to modify custom Safe Links policies](safe-links-policies-configure.md#use-the-microsoft-defender-portal-to-modify-custom-safe-links-policies).
67+
68+
1. In the Microsoft Defender portal, go to the **Safe Links** page at <https://security.microsoft.com/safelinksv2>.
69+
2. On the **Safe Links** page, verify Teams integration is turned on in any custom policies (policies with a numerical **Priority** value) by doing the following steps:
70+
1. Select the policy by clicking anywhere in the row other than the check box next to the first column.
71+
2. In the **Teams** section of the **Protection settings** section in the details flyout that opens, verify the value is **On: Safe Links checks a list of known, malicious links when users click links in Microsoft Teams. URLs are not rewritten**.
72+
73+
If the value is **Off**, select **Edit protection settings** at the bottom of the **Protection settings** section. In the **URL & click protection settings** flyout that opens, select the check box in the **Teams** section, select **Save**, and then select **Close**.
74+
75+
Repeat these steps on every custom Safe Links policy.
76+
77+
> [!TIP]
78+
> Teams integration is on in the [Built-in protection preset security policy](preset-security-policies.md), but any other Safe Links policies [take precedence](preset-security-policies.md#order-of-precedence-for-preset-security-policies-and-other-policies) over the Built-in protection preset security policy (as shown in the order they're listed on the **Safe Links** page).
79+
80+
## Step 3: Configure Zero-hour auto purge (ZAP) for Microsoft Teams
81+
82+
For complete instructions, see [Configure ZAP for Teams protection in Defender for Office 365 Plan 2](mdo-support-teams-about.md#configure-zap-for-teams-protection-in-defender-for-office-365-plan-2).
83+
84+
1. In the Microsoft Defender portal, go to the **Microsoft Teams protection** page at <https://security.microsoft.com/securitysettings/teamsProtectionPolicy>.
85+
86+
2. On the **Microsoft Teams protection** page, verify the toggle in the **Zero-hour auto purge (ZAP)** section is :::image type="icon" source="media/scc-toggle-on.png" border="false"::: **On**.
87+
88+
If the value is :::image type="icon" source="media/scc-toggle-off.png" border="false"::: **Off**, move the toggle to :::image type="icon" source="media/scc-toggle-on.png" border="false"::: **On**, and then select **Save**.
89+
90+
> [!TIP]
91+
> When ZAP for Microsoft Teams is turned on, you can use **Exclude these participants** on the **Microsoft Teams protection** page to exclude users from Teams protection. For more information, see [Configure ZAP for Teams protection in Defender for Office 365 Plan 2](mdo-support-teams-about.md#configure-zap-for-teams-protection-in-defender-for-office-365-plan-2).
92+
93+
## Step 4: Configure user reported settings for Microsoft Teams
94+
95+
For complete instructions, see [User reported message settings in Microsoft Teams](submissions-teams.md).
96+
97+
1. In the Teams admin center, go to the **Messaging policies** page at <https://admin.teams.microsoft.com/policies/messaging>.
98+
99+
2. On the **Manage policies** tab of the **Messaging policies** page, verify that the **Manage policies** tab is selected, and do either of the following actions to edit the appropriate policy (the **Global (Org-wide) default** policy for all users or a custom policy for specific users):
100+
- Select the link in the **Name** column.
101+
- Select the policy by clicking anywhere in the row other than the **Name** column, and then select :::image type="icon" source="media/m365-cc-sc-edit-icon.png" border="false"::: **Edit**.
102+
103+
3. In the policy details page that opens, find the **Report a security concern** toggle, and verify the value is :::image type="icon" source="media/scc-toggle-on.png" border="false"::: **On**.
104+
105+
If the value is :::image type="icon" source="media/scc-toggle-off.png" border="false"::: **Off**, move the toggle to :::image type="icon" source="media/scc-toggle-on.png" border="false"::: **On**, and then select **Save**.
106+
107+
4. In the Microsoft Defender portal, go to the **User reported settings** page at <https://security.microsoft.com/securitysettings/userSubmission>.
108+
109+
5. On the **User reported settings** page, go to the **Microsoft Teams** section, and verify **Monitor reported messages in Microsoft Teams** is selected.
110+
111+
If it's not selected, select the check box, and then select **Save**.

‎defender-office-365/mdo-support-teams-sec-ops-guide.md‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
---
2+
title: Security Operations Guide for Teams protection
3+
f1.keywords:
4+
- NOCSH
5+
ms.author: chrisda
6+
author: chrisda
7+
manager: deniseb
8+
audience: Admin
9+
ms.topic: overview
10+
ms.localizationpriority: medium
11+
search.appverid:
12+
- MET150
13+
- MOE150
14+
ms.collection:
15+
- m365-security
16+
- tier1
17+
description: A prescriptive playbook for SecOps personnel to manage Microsoft Teams protection in Microsoft Defender for Office 365.
18+
ms.service: defender-office-365
19+
ms.date: 04/16/2025
20+
appliesto:
21+
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 2</a>
22+
---
23+
24+
# Security Operations Guide for Teams protection in Microsoft Defender for Office 365
25+
26+
After you [configure Microsoft Teams protection in Microsoft Defender for Office 365](mdo-support-teams-quick-configure.md), you need to integrate Teams protection capabilities into your Security Operations (SecOps) response processes. This process is critical to ensure a high-quality, reliable approach to protect, detect, and respond to collaboration-related security threats.
27+
28+
Involving the SecOps team during the deployment/pilot phases ensures your organization is ready to deal with threats. Teams protection capabilities in Defender for Office 365 are natively integrated into the existing Defender for Office 365 and Defender XDR SecOps tools and work flows.
29+
30+
Another important step is to ensure SecOps team members have the appropriate permissions to do their tasks.
31+
32+
<!--- We need links to what permissions, or can we just say Security Administrator --->
33+
34+
## Integrate user reported Teams messages into SecOps incident response
35+
36+
When users report Teams messages as potentially malicious, the reported messages are sent to Microsoft and/or the reporting mailbox as defined by the [user reported settings in Defender for Office 365](submissions-user-reported-messages-custom-mailbox.md).
37+
38+
The **Teams message reported by user as security risk** alert is automatically generated and correlated to Defender XDR Incidents.
39+
40+
We strongly recommend that SecOps team members start triage and investigation from the [Defender XDR incidents queue in the Microsoft Defender portal](/defender-office-365/mdo-sec-ops-manage-incidents-and-alerts) or SIEM/SOAR integration.
41+
42+
> [!TIP]
43+
> Currently, **Teams message reported by user as security risk** alerts don't generate automated investigation and response (AIR) investigations.
44+
45+
SecOps team members can review submitted Teams message details in the following locations in the Defender portal:
46+
47+
- The **View submission** action in the Defender XDR incident.
48+
- The **User reported** tab of the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=user>:
49+
- Admins can submit user reported Teams messages to Microsoft for analysis from the **User reported** tab. Entries on the **Teams messages** tab are the result of manually submitting user reported Teams message to Microsoft ([converting the user submission to an admin submission](submissions-admin.md#submit-user-reported-messages-to-microsoft-for-analysis)).
50+
- Admins can use **Mark and notify** on reported Teams messages to send response email to users who reported messages.
51+
52+
SecOps team members can also use block entries in the Tenant Allow/Block List to block the following indicators of compromise:
53+
54+
- Suspicious URLs as yet unidentified by Defender for Office 365. URL block entries are enforced at time of click in Teams when [Teams integration in Safe Links policies is turned on](mdo-support-teams-quick-configure.md#step-2-verify-safe-links-integration-for-microsoft-teams).
55+
- Files by using the SHA256 hash value.
56+
57+
## Enable SecOps to proactively manage false negatives in Microsoft Teams
58+
59+
SecOps team members can use threat hunting or information from external threat intelligence feeds to proactively respond to false negative Teams messages (bad messages allowed). They can use the information to proactively block threats. For example:
60+
61+
- [Create URL block entries](tenant-allow-block-list-urls-configure.md#create-block-entries-for-urls) in the Tenant Allow/Block List in Defender for Office 365. Block entries apply at time of click for URLs in Teams.
62+
- [Block domains in Teams using the Teams admin center](/microsoftteams/trusted-organizations-external-meetings-chat#specify-trusted-microsoft-365-organizations).
63+
- Submit undetected URLs to Microsoft using [admin submission](submissions-admin.md#report-questionable-urls-to-microsoft).
64+
65+
> [!TIP]
66+
> As previously described, admins can't proactively submit Teams messages to Microsoft for analysis. Instead, they submit user reported Teams messages to Microsoft ([converting the user submission to an admin submission](submissions-admin.md#submit-user-reported-messages-to-microsoft-for-analysis)).
67+
68+
## Enable SecOps to manage false positives in Microsoft Teams
69+
70+
SecOps team members can triage and respond to false positive Teams messages (good messages blocked) on the **Quarantine** page in Defender for Office 365 at <https://security.microsoft.com/quarantine>.
71+
72+
- Teams messages detected by zero-hour auto protection (ZAP) are available on the **Teams messages** tab. SecOps team members can [take action](quarantine-admin-manage-messages-files.md#take-action-on-quarantined-teams-messages) on these messages. For example, preview messages, download messages, submit messages to Microsoft for review, and release the messages from quarantine.
73+
74+
> [!TIP]
75+
> Teams messages released from quarantine are available to senders and recipients in the original location in Teams chats and channel posts.
76+
77+
- Files in Teams messages detected by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams are available on the **Files** tab. SecOps team members can [take action](quarantine-admin-manage-messages-files.md#take-action-on-quarantined-files) on these files. For example, view file details, download files, submit messages to Microsoft for review, and release the files from quarantine.
78+
79+
> [!TIP]
80+
> Files released from quarantine are available to users in the original location in SharePoint, OneDrive, and Teams.
81+
82+
## Enable SecOps to hunt for threats and detections in Microsoft Teams
83+
84+
SecOps team members can proactively hunt for potentially malicious Teams messages, URL clicks in Teams, and file detected as malicious. You can use this information to find potential threats, analyze patterns, and develop custom detections in Defender XDR to automatically generate incidents.
85+
86+
- On the **Explorer** page (Threat Explorer) in the Defender portal at <https://security.microsoft.com/threatexplorerv3>:
87+
- **Content malware** tab: This tab contains files detected by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams. You can use the [available filters](threat-explorer-real-time-detections-about.md#filterable-properties-in-the-content-malware-view-in-threat-explorer-and-real-time-detections) to hunt on detection data.
88+
- **URL click** tab: This tab contains all user clicks on URLs in email, in supported Office files in SharePoint and OneDrive, and in Microsoft Teams. You can use the [available filters](threat-explorer-real-time-detections-about.md#filterable-properties-in-the-url-clicks-view-in-threat-explorer) to hunt on detection data.
89+
90+
- On the **Advanced hunting** page in the Defender portal at <https://security.microsoft.com/v2/advanced-hunting>. The following hunting tables are available for Teams-related threats:
91+
- [MessageEvents](/defender-xdr/advanced-hunting-messageevents-table): Contains raw data about every internal and external Teams message that included a URL. Sender address, Sender display name, Sender type, and more are available in this table.
92+
- [MessagePostDeliveryEvents](/defender-xdr/advanced-hunting-messagepostdeliveryevents-table): Contains raw data about ZAP events on Teams messages.
93+
- [MessageUrlInfo](/defender-xdr/advanced-hunting-messageurlinfo-table): Contains raw data about URLs in Teams messages.
94+
- [UrlClickEvents](/defender-xdr/advanced-hunting-urlclickevents-table): Contains raw data about every allowed or blocked URL click by users in Teams clients.
95+
96+
SecOps team members can join these hunting tables with other workload tables (for example, EmailEvents or Device-related tables) to gain insight into end to end user activities.
97+
98+
For example, you can use the following query to hunt for allowed clicks on URLs in Teams messages that were removed by ZAP:
99+
100+
```kusto
101+
MessagePostDeliveryEvents
102+
| join MessageUrlInfo on TeamsMessageId
103+
| join UrlClickEvents on Url
104+
| join EmailUrlInfo on Url
105+
| where Workload == "Teams" and ActionType1 == "ClickAllowed"
106+
| project TimeGenerated, TeamsMessageId, ActionType, RecipientDetails, LatestDeliveryLocation, Url, ActionType1
107+
```
108+
109+
[Community queries in advanced hunting](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/use-community-queries-to-hunt-more-effectively-across-email-and-collaboration-th/4254664) also offers Teams query examples.

0 commit comments

Comments
 (0)