You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-office-365/reports-defender-for-office-365.md
+19-17Lines changed: 19 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,7 +19,7 @@ description: Admins can learn how to find and use the Defender for Office 365 re
19
19
ms.custom:
20
20
- seo-marvel-apr2020
21
21
ms.service: defender-office-365
22
-
ms.date: 3/7/2024
22
+
ms.date: 6/27/2025
23
23
appliesto:
24
24
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
@@ -37,13 +37,15 @@ Summary information for each report is available on the page. Identify the repor
37
37
38
38
The rest of this article describes the reports that are exclusive to Defender for Office 365.
39
39
40
-
> [!NOTE]
40
+
> [!TIP]
41
+
>
42
+
> An Overview dashboard for Microsoft 365 is available at **Email & collaboration**\>**Overview** or directly at <https://security.microsoft.com/emailandcollaborationoverviewreport>. For more information, see [The Microsoft Defender for Office 365 Overview dashboard](reports-mdo-email-collaboration-dashboard.md).
41
43
>
42
44
> Email security reports that don't require Defender for Office 365 are described in [View email security reports in the Microsoft Defender portal](reports-email-security.md).
43
45
>
44
-
> For reports that have been deprecated or replaced, see the table in [Email security report changes in the Microsoft Defender portal](reports-email-security.md#email-security-report-changes-in-the-microsoft-defender-portal).
46
+
> For deprecated or replaced reports, see the table in [Email security report changes in the Microsoft Defender portal](reports-email-security.md#email-security-report-changes-in-the-microsoft-defender-portal).
45
47
>
46
-
> Reports that are related to mail flow are now in the Exchange admin center (EAC). For more information about these reports, see [Mail flow reports in the new Exchange admin center](/exchange/monitoring/mail-flow-reports/mail-flow-reports).
48
+
> Reports related to mail flow are now in the Exchange admin center (EAC). For more information about these reports, see [Mail flow reports in the new Exchange admin center](/exchange/monitoring/mail-flow-reports/mail-flow-reports).
47
49
48
50
Watch this short video to learn how you can use reports to understand the effectiveness of Defender for Office 365 in your organization.
49
51
@@ -52,16 +54,16 @@ Watch this short video to learn how you can use reports to understand the effect
52
54
## Safe Attachments file types report
53
55
54
56
> [!NOTE]
55
-
> This report has been deprecated. The same information is available in the [Threat protection status report](#threat-protection-status-report).
57
+
> This report is deprecated. The same information is available in the [Threat protection status report](#threat-protection-status-report).
56
58
57
59
## Safe Attachments message disposition report
58
60
59
61
> [!NOTE]
60
-
> This report has been deprecated. The same information is available in the [Threat protection status report](#threat-protection-status-report).
62
+
> This report is deprecated. The same information is available in the [Threat protection status report](#threat-protection-status-report).
61
63
62
64
## Mail latency report
63
65
64
-
The **Mail latency report** shows you an aggregate view of the mail delivery and detonation latency experienced within your Defender for Office 365 organization. Mail delivery times in the service are affected by many factors, and the absolute delivery time in seconds is often not a good indicator of success or a problem. A slow delivery time on one day might be considered an average delivery time on another day, or vice-versa. This report tries to qualify message delivery based on statistical data about the observed delivery times of other messages.
66
+
The **Mail latency report** shows you an aggregate view of the mail delivery and detonation latency experienced within your Defender for Office 365 organization. Many factors affect mail delivery times in the service, and the absolute delivery time in seconds is often not a good indicator of success or a problem. A slow delivery time on one day might be considered an average delivery time on another day, or vice-versa. This report tries to qualify message delivery based on statistical data about the observed delivery times of other messages.
65
67
66
68
Client-side latency and network latency aren't included in the results.
67
69
@@ -96,10 +98,10 @@ In the details table below the chart, the following information is available:
96
98
Select :::image type="icon" source="media/m365-cc-sc-filter-icon.png" border="false"::: **Filter** to modify the report and the details table by selecting one or more of the following values in the flyout that opens:
97
99
98
100
-**Date (UTC)**: **Start date** and **End date**
99
-
-**Message view**: Select one of tne of the following values:
101
+
-**Message view**: Select one of the following values:
100
102
-**All email**
101
103
-**Detonated email**: After you select this value, select one of the following values that appears:
102
-
-**Inline detonation**: Links and attachments in messages are fully tested by Safe Links and Safe Attachments before delivery.
104
+
-**Inline detonation**: Safe Links and Safe Attachments fully test links and attachments in messages before delivery.
103
105
-**Asynchronous detonation**: [Dynamic delivery](safe-attachments-about.md#dynamic-delivery-in-safe-attachments-policies) of attachments by Safe Attachments and links in email tested by Safe Links after delivery.
104
106
105
107
When you're finished configuring the filters, select **Apply**, **Cancel**, or :::image type="icon" source="media/m365-cc-sc-clear-filters-icon.png" border="false"::: **Clear filters**.
@@ -119,9 +121,9 @@ On the **Email & collaboration reports** page at <https://security.microsoft.com
119
121
On the **Post-delivery activities** page, the chart shows the following information for the specified date range:
120
122
121
123
-**No threat**: The number of unique delivered messages that were found to be not spam by ZAP.
122
-
-**Spam**: The number of unique messages that were removed from mailboxes by ZAP for spam.
123
-
-**Phishing**: The number of unique messages that were removed from mailboxes by ZAP for phishing.
124
-
-**Malware**: The number of unique messages that were removed from mailboxes by ZAP for phishing.
124
+
-**Spam**: The number of unique messages removed from mailboxes by ZAP for spam.
125
+
-**Phishing**: The number of unique messages removed from mailboxes by ZAP for phishing.
126
+
-**Malware**: The number of unique messages removed from mailboxes by ZAP for phishing.
125
127
126
128
The details table below the graph shows the following information:
127
129
@@ -145,7 +147,7 @@ The details table below the graph shows the following information:
145
147
Select :::image type="icon" source="media/m365-cc-sc-filter-icon.png" border="false"::: **Filter** to modify the report and the details table by selecting one or more of the following values in the flyout that opens:
146
148
147
149
-**Date (UTC)**: **Start date** and **End date**.
148
-
-**Updated threat**: Select one ore mor of the following values:
150
+
-**Updated threat**: Select one ore more of the following values:
149
151
-**No threat**
150
152
-**Spam**
151
153
-**Phishing**
@@ -186,11 +188,11 @@ The **View data by URL click protection action** view shows the number of URL cl
186
188
-**Blocked**: Click blocked.
187
189
-**Blocked by tenant admin**: The Clicks blocked in Safe Links policies.
188
190
-**Blocked and clicked through**: Blocked clicks where users click through to the blocked URL.
189
-
-**Blocked by tenant admin and clicked through**: Admin has blocked the link, but the user clicked through.
191
+
-**Blocked by tenant admin and clicked through**: An admin blocked the link, but the user clicked through.
190
192
-**Clicked through during scan**: Clicks where users click through the pending scan page to the URL.
191
193
-**Pending scan**: Clicks on URLs that are pending a scan verdict.
192
194
193
-
A click indicates that the user has clicked through the block page to the malicious website (admins can disable click through in Safe Links policies).
195
+
A click indicates the user clicked through the block page to the malicious website (admins can disable click through in Safe Links policies).
194
196
195
197
The details table below the chart provides the following near-real-time view of all clicks that happened within the organization for the last 30 days:
196
198
@@ -219,7 +221,7 @@ On the **URL threat protection** page, the :::image type="icon" source="media/m3
219
221
:::image type="content" source="media/url-threat-protection-report-url-click-by-application-view.png" alt-text="The URL click protection action view in the URL protection report" lightbox="media/url-threat-protection-report-url-click-by-application-view.png":::
220
222
221
223
> [!TIP]
222
-
> URL clicks by guest users are available in the report. Guest user accounts might be compromised or access malicious content inside the organization.
224
+
> URL clicks by guests are available in the report. Guest accounts might be compromised or access malicious content inside the organization.
223
225
224
226
The **View data by URL click by application** view shows the number of URL clicks by apps that support Safe Links:
225
227
@@ -250,7 +252,7 @@ When you're finished configuring the filters, select **Apply**, **Cancel**, or :
250
252
251
253
On the **URL threat protection** page, the :::image type="icon" source="media/m365-cc-sc-create-icon.png" border="false"::: **[Create schedule](reports-email-security.md#schedule-recurring-reports)**, :::image type="icon" source="media/m365-cc-sc-download-icon.png" border="false"::: **[Request report](reports-email-security.md#request-on-demand-reports-for-download)**, and :::image type="icon" source="media/m365-cc-sc-download-icon.png" border="false"::: **[Export](reports-email-security.md#export-report-data)** actions are available.
252
254
253
-
## Additional reports to view
255
+
## Other reports to view
254
256
255
257
In addition to the reports described in this article, the following tables describe other available reports that are available:
0 commit comments