Skip to content

Commit 6e6dc53

Browse files
committed
Dispute updates
1 parent 1f7c404 commit 6e6dc53

File tree

3 files changed

+34
-12
lines changed

3 files changed

+34
-12
lines changed
6.78 KB
Loading
29.9 KB
Loading

defender-office-365/submissions-admin.md

Lines changed: 34 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ ms.collection:
1616
ms.custom: seo-marvel-apr2020
1717
description: "Admins can learn how to use the Submissions page in the Microsoft Defender portal to submit messages, URLs, and email attachments to Microsoft for analysis. Reasons for submission include: legitimate messages that were blocked, suspicious messages that were allowed, suspected phishing email, spam, malware, and other potentially harmful messages."
1818
ms.service: defender-office-365
19-
ms.date: 07/14/2025
19+
ms.date: 07/24/2025
2020
appliesto:
2121
- ✅ <a href="https://learn.microsoft.com/defender-office-365/eop-about" target="_blank">Exchange Online Protection</a>
2222
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
@@ -527,6 +527,12 @@ The next sections in the details flyout are related to email message submissions
527527
- **View Exchange mail flow rules (transport rules)**
528528
- **View this message in Explorer** (Threat Explorer or Real-time detections in Defender for Office 365 only)
529529
- **Search for similar messages in Explorer** (Threat Explorer or Real-time detections in Defender for Office 365 only)
530+
- If you [disputed the verdict on the message](#dispute-the-result-for-submissions-to-microsoft), a box shows information about the dispute results:
531+
- The date and email address of the admin who disputed the message.
532+
- **View dispute details**: A read only copy of the **Dispute details** flyout that the admin filled out when they disputed the message.
533+
- **View original submission**: The original details flyout of the email message submission.
534+
535+
:::image type="content" source="media/submissions-dispute-info-in-details-flyout.png" alt-text="Screenshot of the disputed results box for email messages." lightbox="media/submissions-dispute-info-in-details-flyout.png":::
530536

531537
- **Submission details** section:
532538
- **Date submitted**
@@ -661,7 +667,6 @@ You can sort the entries by clicking on an available column header. Select :::im
661667
- **Object ID**
662668
- **Policy action**
663669
- **Submitted by**
664-
- - **Is dispute**: For more information, see [Dispute the result for submissions to Microsoft](#dispute-the-result-for-submissions-to-microsoft).
665670
- **Tags**<sup>\*</sup>: For more information about user tags, see [User tags](user-tags-about.md).
666671
- **Action**
667672

@@ -670,7 +675,6 @@ To group the entries, select :::image type="icon" source="media/m365-cc-sc-group
670675
- **Reason**
671676
- **Status**
672677
- **Result**
673-
- **Dispute status**
674678
- **Tags**
675679

676680
To ungroup the entries, select **None**.
@@ -807,6 +811,12 @@ The remaining sections in the details flyout are related to URL submissions:
807811
- **Should not have been blocked**
808812
- **Recommended steps for email submissions**: Contains links to related actions. For example:
809813
- **Block URL/file in Tenant Allow/Block List**
814+
- If you [disputed the verdict on the URL](#dispute-the-result-for-submissions-to-microsoft), a box shows information about the dispute results:
815+
- The date and email address of the admin who disputed the message.
816+
- **View dispute details**: A read only copy of the **Dispute details** flyout that the admin filled out when they disputed the message.
817+
- **View original submission**: The original details flyout of the URL submission.
818+
819+
:::image type="content" source="media/submissions-dispute-info-in-details-flyout.png" alt-text="Screenshot of the disputed results box for URLs." lightbox="media/submissions-dispute-info-in-details-flyout.png":::
810820

811821
- **Submission details** section:
812822
- **Date submitted**
@@ -848,19 +858,23 @@ When you disagree with the verdict of an email or URL you submitted to Microsoft
848858
- The analysis starts over with no previous verdict or history.
849859
- You can resubmit an item multiple times.
850860

851-
You can use the procedures in this section to dispute the following items:
861+
You can use the procedures in this section to dispute admin submitted items that meet **all** of the following criteria:
852862

853-
- Admin submitted items from the **Emails**, **Email attachments**, or **URLs** tabs where that **Status** value is **Completed** and **Result** isn't one of the following values:
854-
- **Allowed due to user overrides**
855-
- **Item was not found**
856-
- **We did not receive the submission, please fix the problem and resubmit**
863+
- The item was submitted from the **Emails** or **URLs** tabs of the **Submissions** page.
864+
- The **Status** property value is **Completed**.
865+
- The **Result** property is one of the following values:
866+
- **Threats found**
867+
- **No threats found**
868+
- **Spam**
869+
- **Bulk**
870+
- The item wasn't previously disputed (filter by **Is dispute** \> **No**).
857871

858-
To dispute items from the **User submitted** tab, you first need to [convert the user submission to an admin submission](#submit-user-reported-messages-to-microsoft-for-analysis).
872+
> [!TIP]
873+
> To dispute items on the **User submitted** tab, you first need to [convert the user submission to an admin submission](#submit-user-reported-messages-to-microsoft-for-analysis).
859874
860-
1. On the **Submissions** page in the Defender portal, go to the **Emails**, **Email attachments**, or **URLs** tabs:
875+
1. On the **Submissions** page in the Defender portal, go to the **Emails**, or **URLs** tabs:
861876
- **Emails** tab: <https://security.microsoft.com/reportsubmission?viewid=email>
862877
- **URLs** tab: <https://security.microsoft.com/reportsubmission?viewid=url>
863-
- **Email attachments** tab: <https://security.microsoft.com/reportsubmission?viewid=emailAttachment>
864878

865879
2. On the tab, do one of the following steps:
866880
- Select one or more eligible items by selecting the check box next to the first column, and then select the :::image type="icon" source="media/m365-cc-sc-create-icon.png" border="false"::: **Dispute submission result** action that appears.
@@ -883,7 +897,13 @@ You can use the procedures in this section to dispute the following items:
883897

884898
:::image type="content" source="media/submissions-dispute-options-flyout.png" alt-text="Screenshot of the Dispute details flyout." lightbox="media/submissions-dispute-options-flyout.png":::
885899

886-
On the **Emails**, **Email attachments**, or **URLs** tabs, the following controls are available for disputed items:
900+
4. On the **Dispute submitted** flyout, select **Done**.
901+
902+
:::image type="content" source="media/submissions-dispute-submitted.png" alt-text="Screenshot of the Dispute submitted flyout." lightbox="media/submissions-dispute-submitted.png":::
903+
904+
#### View disputed items
905+
906+
On the **Emails** or **URLs** tabs of the **Submissions** page, the following controls are available for disputed items:
887907

888908
- :::image type="icon" source="media/m365-cc-sc-group-icon.png" border="false"::: **Group** \> **Dispute status** groups entries on the page into the following categories:
889909
- **Not disputed**
@@ -894,6 +914,8 @@ On the **Emails**, **Email attachments**, or **URLs** tabs, the following contro
894914

895915
- :::image type="icon" source="media/m365-cc-sc-filter-icon.png" border="false"::: **Filter** \> **Is dispute** \> **Yes** or **No** filters filters the entries on the page by whether the item was disputed.
896916

917+
The details flyout for the [email message](#view-email-admin-submission-details) or [URL](#view-url-admin-submission-details) submission contains information and links about the disputed item.
918+
897919
### Actions for admin submissions in Defender for Office 365
898920

899921
In organizations with Microsoft Defender for Office 365 (add-on licenses or included in subscriptions like Microsoft 365 E5 or Microsoft 365 Business Premium), the following actions are available for admin submissions in the details flyout that opens after you select an entry from the list by clicking anywhere in the row other than the check box:

0 commit comments

Comments
 (0)