You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-office-365/submissions-admin.md
+34-12Lines changed: 34 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ ms.collection:
16
16
ms.custom: seo-marvel-apr2020
17
17
description: "Admins can learn how to use the Submissions page in the Microsoft Defender portal to submit messages, URLs, and email attachments to Microsoft for analysis. Reasons for submission include: legitimate messages that were blocked, suspicious messages that were allowed, suspected phishing email, spam, malware, and other potentially harmful messages."
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
@@ -527,6 +527,12 @@ The next sections in the details flyout are related to email message submissions
527
527
-**View Exchange mail flow rules (transport rules)**
528
528
-**View this message in Explorer** (Threat Explorer or Real-time detections in Defender for Office 365 only)
529
529
-**Search for similar messages in Explorer** (Threat Explorer or Real-time detections in Defender for Office 365 only)
530
+
- If you [disputed the verdict on the message](#dispute-the-result-for-submissions-to-microsoft), a box shows information about the dispute results:
531
+
- The date and email address of the admin who disputed the message.
532
+
-**View dispute details**: A read only copy of the **Dispute details** flyout that the admin filled out when they disputed the message.
533
+
-**View original submission**: The original details flyout of the email message submission.
534
+
535
+
:::image type="content" source="media/submissions-dispute-info-in-details-flyout.png" alt-text="Screenshot of the disputed results box for email messages." lightbox="media/submissions-dispute-info-in-details-flyout.png":::
530
536
531
537
-**Submission details** section:
532
538
-**Date submitted**
@@ -661,7 +667,6 @@ You can sort the entries by clicking on an available column header. Select :::im
661
667
-**Object ID**
662
668
-**Policy action**
663
669
-**Submitted by**
664
-
--**Is dispute**: For more information, see [Dispute the result for submissions to Microsoft](#dispute-the-result-for-submissions-to-microsoft).
665
670
-**Tags**<sup>\*</sup>: For more information about user tags, see [User tags](user-tags-about.md).
666
671
-**Action**
667
672
@@ -670,7 +675,6 @@ To group the entries, select :::image type="icon" source="media/m365-cc-sc-group
670
675
-**Reason**
671
676
-**Status**
672
677
-**Result**
673
-
-**Dispute status**
674
678
-**Tags**
675
679
676
680
To ungroup the entries, select **None**.
@@ -807,6 +811,12 @@ The remaining sections in the details flyout are related to URL submissions:
807
811
-**Should not have been blocked**
808
812
-**Recommended steps for email submissions**: Contains links to related actions. For example:
809
813
-**Block URL/file in Tenant Allow/Block List**
814
+
- If you [disputed the verdict on the URL](#dispute-the-result-for-submissions-to-microsoft), a box shows information about the dispute results:
815
+
- The date and email address of the admin who disputed the message.
816
+
-**View dispute details**: A read only copy of the **Dispute details** flyout that the admin filled out when they disputed the message.
817
+
-**View original submission**: The original details flyout of the URL submission.
818
+
819
+
:::image type="content" source="media/submissions-dispute-info-in-details-flyout.png" alt-text="Screenshot of the disputed results box for URLs." lightbox="media/submissions-dispute-info-in-details-flyout.png":::
810
820
811
821
-**Submission details** section:
812
822
-**Date submitted**
@@ -848,19 +858,23 @@ When you disagree with the verdict of an email or URL you submitted to Microsoft
848
858
- The analysis starts over with no previous verdict or history.
849
859
- You can resubmit an item multiple times.
850
860
851
-
You can use the procedures in this section to dispute the following items:
861
+
You can use the procedures in this section to dispute admin submitted items that meet **all** of the following criteria:
852
862
853
-
- Admin submitted items from the **Emails**, **Email attachments**, or **URLs** tabs where that **Status** value is **Completed** and **Result** isn't one of the following values:
854
-
-**Allowed due to user overrides**
855
-
-**Item was not found**
856
-
-**We did not receive the submission, please fix the problem and resubmit**
863
+
- The item was submitted from the **Emails** or **URLs** tabs of the **Submissions** page.
864
+
- The **Status** property value is **Completed**.
865
+
- The **Result** property is one of the following values:
866
+
-**Threats found**
867
+
-**No threats found**
868
+
-**Spam**
869
+
-**Bulk**
870
+
- The item wasn't previously disputed (filter by **Is dispute**\>**No**).
857
871
858
-
To dispute items from the **User submitted** tab, you first need to [convert the user submission to an admin submission](#submit-user-reported-messages-to-microsoft-for-analysis).
872
+
> [!TIP]
873
+
> To dispute items on the **User submitted** tab, you first need to [convert the user submission to an admin submission](#submit-user-reported-messages-to-microsoft-for-analysis).
859
874
860
-
1. On the **Submissions** page in the Defender portal, go to the **Emails**, **Email attachments**, or **URLs** tabs:
875
+
1. On the **Submissions** page in the Defender portal, go to the **Emails**, or **URLs** tabs:
- Select one or more eligible items by selecting the check box next to the first column, and then select the :::image type="icon" source="media/m365-cc-sc-create-icon.png" border="false"::: **Dispute submission result** action that appears.
@@ -883,7 +897,13 @@ You can use the procedures in this section to dispute the following items:
883
897
884
898
:::image type="content" source="media/submissions-dispute-options-flyout.png" alt-text="Screenshot of the Dispute details flyout." lightbox="media/submissions-dispute-options-flyout.png":::
885
899
886
-
On the **Emails**, **Email attachments**, or **URLs** tabs, the following controls are available for disputed items:
900
+
4. On the **Dispute submitted** flyout, select **Done**.
901
+
902
+
:::image type="content" source="media/submissions-dispute-submitted.png" alt-text="Screenshot of the Dispute submitted flyout." lightbox="media/submissions-dispute-submitted.png":::
903
+
904
+
#### View disputed items
905
+
906
+
On the **Emails** or **URLs** tabs of the **Submissions** page, the following controls are available for disputed items:
887
907
888
908
- :::image type="icon" source="media/m365-cc-sc-group-icon.png" border="false"::: **Group**\>**Dispute status** groups entries on the page into the following categories:
889
909
-**Not disputed**
@@ -894,6 +914,8 @@ On the **Emails**, **Email attachments**, or **URLs** tabs, the following contro
894
914
895
915
- :::image type="icon" source="media/m365-cc-sc-filter-icon.png" border="false"::: **Filter**\>**Is dispute**\>**Yes** or **No** filters filters the entries on the page by whether the item was disputed.
896
916
917
+
The details flyout for the [email message](#view-email-admin-submission-details) or [URL](#view-url-admin-submission-details) submission contains information and links about the disputed item.
918
+
897
919
### Actions for admin submissions in Defender for Office 365
898
920
899
921
In organizations with Microsoft Defender for Office 365 (add-on licenses or included in subscriptions like Microsoft 365 E5 or Microsoft 365 Business Premium), the following actions are available for admin submissions in the details flyout that opens after you select an entry from the list by clicking anywhere in the row other than the check box:
0 commit comments