You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-office-365/anti-phishing-protection-spoofing-about.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -158,7 +158,7 @@ Mailing lists (also known as discussion lists) are known to have problems with a
158
158
For example, Gabriela Laureano (`[email protected]`) is interested in bird watching, so she joins the mailing list `[email protected]`, and sends the following message to the list:
Copy file name to clipboardExpand all lines: defender-office-365/anti-spam-bulk-senders-insight.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -101,7 +101,7 @@ The bulk senders insight is available in the following locations:
101
101
- On the **Email & collaboration reports and insights** page:
102
102
103
103
1. In the Microsoft Defender portal at <https://security.microsoft.com>, go to **Reports**\>**Email & collaboration** section \>**Email & collaboration reports and insights**. Or, to go directly to the **Email & collaboration reports and insights** page, use <https://security.microsoft.com/emailandcollabreport>.
104
-
104
+
105
105
2. On the **Email & collaboration reports and insights** page, go to the **Email & collaboration insights** section and find the **Bulk senders insight**.
106
106
107
107
:::image type="content" source="media/insights-page-bulk-senders-insight.png" alt-text="The bulk senders insight on the Email & collaboration reports and insights page in the Microsoft Defender portal." lightbox="media/insights-page-bulk-senders-insight.png":::
Copy file name to clipboardExpand all lines: defender-office-365/attack-simulation-training-faq.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -99,7 +99,7 @@ By default, Outlook is configured to block automatic image downloads in messages
99
99
100
100
### I see clicks or compromise events from users who insist they didn't click the link in the simulation message OR I see clicks within a few seconds of delivery for many users (false positives). What's going on?
101
101
102
-
These events can occur when other security devices or applications inspect simulation messages. For example (but not limited to):
102
+
These events can occur when other security devices or applications inspect simulation messages. For example (but not limited to):
103
103
104
104
- Applications or plugins within Outlook that inspect or intercept the message.
Copy file name to clipboardExpand all lines: defender-office-365/attack-simulation-training-get-started.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -85,7 +85,7 @@ Watch this short video to learn more about Attack simulation training.
85
85
> [!NOTE]
86
86
> NOR, ZAF, ARE and DEU are the latest additions. All features except reported email telemetry are available in these regions. We're working to enable the features and we'll notify customers as soon as reported email telemetry becomes available.
87
87
88
-
- Attack simulation training is available in Microsoft 365 GCC, GCC High and DoD environments, but certain advanced features aren't available in GCC High and DoD (for example, payload automation, recommended payloads, the predicted compromised rate). If your organization has Microsoft 365 G5, Office 365 G5 or Microsoft Defender for Office 365 (Plan 2) for Government, you can use Attack simulation training as described in this article.
88
+
- Attack simulation training is available in Microsoft 365 GCC, GCC High and DoD environments, but certain advanced features aren't available in GCC High and DoD (for example, payload automation, recommended payloads, the predicted compromised rate). If your organization has Microsoft 365 G5, Office 365 G5 or Microsoft Defender for Office 365 (Plan 2) for Government, you can use Attack simulation training as described in this article.
89
89
90
90
> [!NOTE]
91
91
> Attack simulation training offers a subset of capabilities to E3 customers as a trial. The trial offering contains the ability to use a Credential Harvest payload and the ability to select 'ISA Phishing' or 'Mass Market Phishing' training experiences. No other capabilities are part of the E3 trial offering.
Copy file name to clipboardExpand all lines: defender-office-365/attack-simulation-training-simulation-automations.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -574,12 +574,12 @@ When you're finished, select **Next**.
574
574
What you see on the **Schedule details** page depends on whether you selected **Randomized** or **Fixed** for the simulation schedule on the previous page.
575
575
576
576
-**Randomized** simulation schedule: The following settings are available:
577
-
-**Automation start** section: Use **Select the date you want the automation to start from** to select the start date for the simulations. You can select any future date of up to a year.
577
+
-**Automation start** section: Use **Select the date you want the automation to start from** to select the start date for the simulations. You can select any future date of up to a year.
578
578
579
579
-**Automation scoping** section: Configure the following settings:
580
580
-**Select the days of the week that simulations are allowed to start on**: Select one or more days of the week.
581
581
-**Enter the maximum number of simulations that can be started between the start and end dates**: Enter a value from 1 to 10. This number will also determine the number of payloads to be used. If you choose more payloads than simulations, e.g., 12 payloads for 10 simulations, any 10 of the 12 payloads will be used. If you choose fewer payloads than simulations, e.g., 5 payloads for 8 simulations, some payloads will repeat to cover all the simulations, unless you have chosen **Use unique payloads across simulations within an automation** in the **Launch details**.
582
-
-**Randomize the time of day that simulation emails can be sent for delivery**: Select **Randomize send times** to randomize the send times. This will stagger email delivery over a 12 hour window.
582
+
-**Randomize the time of day that simulation emails can be sent for delivery**: Select **Randomize send times** to randomize the send times. This will stagger email delivery over a 12 hour window.
583
583
584
584
-**Automation end** section: Use **Select the date you want the automations to end** to select the end date for the simulations. You can select any future date of upto a year.
585
585
@@ -605,7 +605,7 @@ When you're finished on the **Schedule details** page, select **Next**.
605
605
606
606
On the **Launch details** page, configure the following additional settings for the automation:
607
607
608
-
-**Use unique payloads across simulations within an automation** section: By default, **Unique payloads** isn't selected. Make sure you have chosen enough payloads for the number of simulations you want to run. If you have fewer payloads than simulations you want to run, only a fraction of users will be targeted (calculated as ratio of number of payloads by the number of simulations).
608
+
-**Use unique payloads across simulations within an automation** section: By default, **Unique payloads** isn't selected. Make sure you have chosen enough payloads for the number of simulations you want to run. If you have fewer payloads than simulations you want to run, only a fraction of users will be targeted (calculated as ratio of number of payloads by the number of simulations).
609
609
610
610
-**Target all selected users in every simulation run** section: By default, the target users are divided across different simulations. If you select this option, all chosen target users will be included in every simulation run. Make sure you have chosen as many payloads as the number of simulations you want to run; otherwise, the payloads will start repeating.
611
611
@@ -664,7 +664,7 @@ For simulation automations with the **Status** value **Active** or **Inactive**,
664
664
665
665
## View reports of automated simulations
666
666
667
-
You can view the simulation reports for automated campaigns in the **Simulations** tab. Click on the name of the simulation, having a prefix of **AutomatedSimulation_** and automation name available under the column **Created by**. To view the report click anywhere in the simulation row other than the check box next to the name.
667
+
You can view the simulation reports for automated campaigns in the **Simulations** tab. Click on the name of the simulation, having a prefix of **AutomatedSimulation_** and automation name available under the column **Created by**. To view the report click anywhere in the simulation row other than the check box next to the name.
668
668
669
669
## Frequently asked questions (FAQ) for simulations automations
Copy file name to clipboardExpand all lines: defender-office-365/attack-simulation-training-training-campaigns.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -108,7 +108,7 @@ On the **Target users** page, select who receives the Training campaign. Use the
108
108
- :::image type="icon" source="media/m365-cc-sc-create-icon.png" border="false"::: **Add users**: In the **Add users** flyout that opens, you find and select users and groups to include in the Training campaign. The following group types are supported:
Copy file name to clipboardExpand all lines: defender-office-365/connection-filter-policies-configure.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -193,7 +193,7 @@ For example, the source email server 192.168.1.25 sends email from the domains c
193
193
194
194
### Scenarios where messages from sources in the IP Allow List are still filtered
195
195
196
-
> [!NOTE]
196
+
> [!NOTE]
197
197
> These scenarios apply to all environments: standalone, hybrid, multi-geo, and cross-forest. Filtering behavior is based on security checks (for example, malware detection, phishing protection, or mail flow rules, not on the deployment model.
198
198
199
199
Messages from an email server in your IP Allow List are still subject to spam filtering in the following scenarios:
0 commit comments