Skip to content

Update remediate-malicious-email-delivered-office-365.md #225

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Mar 20, 2025
Merged

Update remediate-malicious-email-delivered-office-365.md #225

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
74548ef
Update remediate-malicious-email-delivered-office-365.md
Yebbenbe Mar 20, 2025
7563869
Update date and clarify recipient count example
chrisda Mar 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions defender-office-365/remediate-malicious-email-delivered-office-365.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ ms.localizationpriority: medium
search.appverid: MET150
description: Threat remediation
ms.service: defender-office-365
ms.date: 01/13/2025
ms.date: 03/20/2025
appliesto:
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 2</a>
---
Expand All @@ -31,7 +31,7 @@ Remediation means to take a prescribed action against a threat. Malicious email
- **Organization limits**: The maximum number of active, concurrent email remediations is 50. Once the limit is reached, no new remediations are triggered until some actions are completed.
- **Email message limits**: If an active remediation involves more than one million email messages, no new email remediations are allowed.
- **Recipient requirements in remediations**:
- The total percentage of selected recipients must be at least 40% of the total email message count in the remediation. For instance, if an email is sent to five recipients, Explorer (Threat Explorer) counts it as five email messages. If the remediation requires the deletion of 5,000 email messages, the remediation must target at least 2,000 recipients.
- The total percentage of selected recipients must be at least 40% of the total email message count in the remediation. If the remediation requires the deletion of 5,000 email messages, the remediation must target at least 2,000 recipients. Explorer (Threat Explorer) counts each recipient as a unique email message. For example, Threat Exporer counts a message sent to 5 addresses as 5 messages.
- If the recipient count is less than 40% of the total email message count, the remediation can't be used to delete more than 1,000 messages that were sent to a single recipient.

- You need to be assigned permissions before you can do the procedures in this article. Admins can take the required action on email messages, but the **Search and Purge** role is required to get those actions approved. To assign the **Search and Purge** role, you have the following options:
Expand Down